Controls on automatic forwarding outside the organisation

#Requires -Modules ExchangeOnlineManagement
# External auto-forwarding settings: outbound spam policies and remote domains. Read-only.

Connect-ExchangeOnline -ShowBanner:$false

$policies = Get-HostedOutboundSpamFilterPolicy | ForEach-Object {
    [pscustomobject]@{ Control = 'Outbound spam policy'; Name = $_.Name; Setting = 'AutoForwardingMode'; Value = "$($_.AutoForwardingMode)" }
}
$domains = Get-RemoteDomain | ForEach-Object {
    [pscustomobject]@{ Control = 'Remote domain'; Name = "$($_.Name) ($($_.DomainName))"; Setting = 'AutoForwardEnabled'; Value = "$($_.AutoForwardEnabled)" }
}

@($policies) + @($domains)

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

• AutoForwardingMode on each outbound spam policy is Automatic, On or Off. Per Microsoft, Automatic was originally equivalent to On and changed to Off for new organisations and those not actively using it; Off blocks automatic external forwarding with a non-delivery report.
• AutoForwardEnabled on each remote domain allows or blocks auto-forwarded messages to that domain. The built-in remote domain named Default covers every domain without its own entry.
• Microsoft notes that when one control allows external forwarding and another blocks it, the block typically wins. These settings don't affect forwarding between internal users.
• ExchangeOnlineManagement 3.10.0 and later require PowerShell 7.6 when run in PowerShell 7 (Windows PowerShell 5.1 is unaffected), per the module release notes.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.