Voice Mail automatically forwarded another internal user

System Admin 0 Reputation points
2026-11-06T09:21:31.1766667+00:00

In our organization one user facing the issue is user speaking conversation sended to voice mail formatted to another internal user at the time no any Teams call. so i need to Trace how is it happen.

Microsoft Teams | Microsoft Teams for business | Meetings and calls | Other
0 comments

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Jayden-P 4,305 Reputation points Independent Advisor
    2026-11-06T09:35:43.2166667+00:00

    Hi @System Admin

    Please refer to the AI answer as it provides helpful information and a good investigation framework for this scenario.

    Based on the guidance provided, I recommend first determining whether this was caused by Teams call routing (call forwarding, delegation, call groups, unanswered call handling, etc.) or by Exchange Online mailbox forwarding/rules after the voicemail was created.

    To narrow this down, please collect the exact voicemail timestamp and review:

    • Teams Call History and Call Analytics for both users around the incident time
    • Call forwarding, delegation, call group, and unanswered call settings for both users
    • Exchange Message Trace for the voicemail message
    • Mailbox forwarding settings and Inbox rules, including hidden rules
    • Audit logs to identify whether any forwarding configuration was added or modified

    The most useful starting point is usually reviewing Teams Call History/Call Analytics together with Get-CsUserCallingSettings, as this can quickly confirm whether the voicemail was routed through Teams before investigating Exchange forwarding scenarios.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-11-06T09:23:01.53+00:00

    A voicemail appearing for another internal user should first be classified as either a Teams call routed to that user or an Exchange voicemail email forwarded after creation, because each path has different tracing evidence.

    Required access includes an appropriate Teams administrator or communications-support role, Exchange Administrator/Organization Management for message tracing, and Purview Audit Logs or View-Only Audit Logs permission for audit searches.

    1. Inspect the voicemail message first

    Cloud Voicemail stores a voicemail as an email with an audio attachment in Exchange. Therefore, mailbox forwarding, Inbox rules, and mail-flow rules can redirect the voicemail even when Teams never forwarded the call.^1^

    Open the voicemail in both users’ Outlook mailboxes, if present, and record:

    • Received time and subject
    • Sender/caller information
    • Internet Message-ID
    • Whether the message exists in both mailboxes
    • Whether Teams call history shows an incoming call for either user at that time

    If both copies have the same Message-ID and trace events show delivery followed by forwarding, investigate Exchange forwarding. Separate voicemail messages or a call entry involving the unexpected user point toward Teams call routing.

    2. Trace the voicemail through Exchange

    In the Exchange admin center, go to Mail flow > Message trace > Start a trace:

    1. Set the time range around the voicemail timestamp.
    2. Add the originally called user and unexpected recipient.
    3. If available, enter the complete Message-ID, including angle brackets.
    4. Run the trace and open the message details.
    5. Look for forwarding, mail-flow-rule processing, and final delivery events.

    Message trace shows whether Exchange received, forwarded, rejected, or delivered a message. Forwarding and mail-flow rules can generate multiple records for the same Message-ID.^2^

    Then inspect mailbox-level forwarding and all Inbox rules, including hidden rules:

    Get-Mailbox -Identity [Email] |
  Format-List ForwardingAddress,ForwardingSmtpAddress,DeliverToMailboxAndForward

Get-InboxRule -Mailbox [Email] -IncludeHidden |
  Format-List Name,Enabled,RedirectTo,ForwardTo,ForwardAsAttachmentTo,Identity

    A nonblank ForwardingAddress indicates forwarding to an internal recipient. DeliverToMailboxAndForward determines whether Exchange retains a copy in the original mailbox.^3^

    Also review organization-wide Exchange mail-flow rules if the mailbox and Inbox-rule results are empty. Mail-flow rules can affect voicemail delivery or modify voicemail messages.^4^

    3. If mailbox forwarding exists, identify who configured it

    In the Microsoft Purview portal > Audit > Search:

    1. Select a date range covering when forwarding might have been enabled.
    2. Leave Activities blank so cmdlet-generated records are included.
    3. Run the search.
    4. Filter the results’ Activity column for Set-Mailbox.
    5. Open each relevant record and inspect:
      • ObjectId: mailbox changed
      • Parameters: forwarding address and delivery behavior
      • UserId: user or administrator who made the change

    This procedure identifies mailbox forwarding created through Set-Mailbox.^5^

    Audit data is not necessarily immediate, and searchable retention depends on licensing. Audit events are typically available after 60–90 minutes for core services.^6^

    4. If Exchange did not forward it, inspect Teams call routing

    Run this separately for the originally called user and the unexpected recipient:

    Get-CsUserCallingSettings -Identity [Email]
Get-CsUserCallingSettings -Identity [Email]

    Review:

    • IsForwardingEnabled, ForwardingType, and ForwardingTarget
    • IsUnansweredEnabled, UnansweredTarget, and UnansweredTargetType
    • Delegates and Delegators
    • CallGroupTargets and GroupMembershipDetails
    • BusyOnBusyOption

    The cmdlet displays forwarding, simultaneous ringing, call groups, delegation, and unanswered-call settings.^7^ It requires Teams PowerShell 4.0.0 or later; BusyOnBusyOption output requires 8.0.0 or later.

    You can also inspect these settings in Teams admin center > Users > Manage users > select the original user > Voice > Call answering rules.^8^

    Finally, use the Teams admin center’s user troubleshooting view to locate the call around the voicemail timestamp. This can establish whether Teams recorded a call involving either user, but call telemetry alone might not prove who historically changed a forwarding setting.^9^

    References

    1. Set up Cloud Voicemail
    2. Message trace in the Exchange admin center in Exchange Online
    3. Respond to a compromised cloud email account
    4. Voicemail messages aren't delivered in Teams or Skype for Business client
    5. Search the audit log to investigate common support issues
    6. Search the audit log
    7. Get-CsUserCallingSettings-Description
    8. Configure call forwarding and delegation settings
    9. Monitor and troubleshoot Teams meetings and calls from the Teams admin center
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.