> For the complete documentation index, see [llms.txt](https://docs.oort.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oort.io/understanding-check-failures/oort-insights/identity-threat-detection-insights/users-with-new-email-forward-rules.md). # Users With New Email Forward Rules Detects users that have new email forwarding rules within the last 7 days. Email forwarding is mostly harmless and comes from the need to deal with life changes and organizational shifts. However, this is also a known bad pattern for people knowing they are about to change jobs and is a cause of data loss. #### **Recommended Actions** Please check if the forward rule is legitimate, for example, contractors and managers, or a potential data loss issue. #### **Default Check Settings** Number of days: 7 #### **Compatibility** [Google Workspace](/integrations/google-workspace-integration.md)