> For the complete documentation index, see [llms.txt](https://docs.oort.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/users-with-new-email-forward-rules.md).

# Users With New Email Forward Rules

Detects users that have new email forwarding rules within the last 7 days.

Email forwarding is mostly harmless and comes from the need to deal with life changes and organizational shifts. However, this is also a known bad pattern for people knowing they are about to change jobs and is a cause of data loss.

#### **Recommended Actions**

Please check if the forward rule is legitimate, for example, contractors and managers, or a potential data loss issue.

#### **Default Check Settings**

Number of days: 7

#### **Compatibility**

[Google Workspace](/integrations/google-workspace-integration.md)

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FDj1aYu7JNif52ozIdly6%2FNew%20Forwarding%20Rule.png?alt=media&amp;token=4df74b19-b8be-41b2-a81c-9d009891fa7a" alt=""><figcaption></figcaption></figure>