Problem
You need to find users who their Gmail setup to auto forward.
Steps
- Open the Investigation Tool.
Security > Security center > Investigation tool - Select Gmail log events as your data source.
- Click Add Condition.
- Add the following condition:
Event > is > Autoforward - Click Group Results.
- Select Owner from the group drop-down.
- If you are happy with the investigation you built and want to retain it, click Save Investigation, located on the right.
- Click Search. The search results show those with auto forwarding set to ON. If there are no results, no one has the setting ON.
See our full list of Investigation tool recipes.
Document Version | Date | Description of Change |
1.0 | 1/10/2024 | Meeting Kyle Monday 1/13 - is this tied to any settings and did I set it up correctly? I am not getting results |
1.1 | 1/13/2025 | Published |