Mail flow rules that redirect or copy mail to other recipients

#Requires -Modules ExchangeOnlineManagement
# Mail flow rules with redirect, Bcc, To or Cc actions. Read-only.

Connect-ExchangeOnline -ShowBanner:$false

Get-TransportRule -ResultSize Unlimited |
    Where-Object { $_.RedirectMessageTo -or $_.BlindCopyTo -or $_.AddToRecipients -or $_.CopyTo } |
    Sort-Object Priority |
    ForEach-Object {
        [pscustomobject]@{
            Rule              = $_.Name
            State             = "$($_.State)"
            Priority          = $_.Priority
            RedirectMessageTo = $_.RedirectMessageTo -join '; '
            BlindCopyTo       = $_.BlindCopyTo -join '; '
            AddToRecipients   = $_.AddToRecipients -join '; '
            CopyTo            = $_.CopyTo -join '; '
        }
    }

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

• Checks the four rule actions that send a message to extra recipients: RedirectMessageTo, BlindCopyTo (Bcc), AddToRecipients (To) and CopyTo (Cc), per the New-TransportRule reference.
• Disabled rules are listed too (State shows which), because enabling one later brings it back into play.
• A legitimate rule (a journaling or compliance copy) is fine; a Bcc to an outside address that nobody can explain is not.
• ExchangeOnlineManagement 3.10.0 and later require PowerShell 7.6 when run in PowerShell 7 (Windows PowerShell 5.1 is unaffected), per the module release notes.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.