Voice Mail automatically forwarded another internal user

A voicemail appearing for another internal user should first be classified as either a Teams call routed to that user or an Exchange voicemail email forwarded after creation, because each path has different tracing evidence.

Required access includes an appropriate Teams administrator or communications-support role, Exchange Administrator/Organization Management for message tracing, and Purview Audit Logs or View-Only Audit Logs permission for audit searches.

1. Inspect the voicemail message first

Cloud Voicemail stores a voicemail as an email with an audio attachment in Exchange. Therefore, mailbox forwarding, Inbox rules, and mail-flow rules can redirect the voicemail even when Teams never forwarded the call.^1^

Open the voicemail in both users’ Outlook mailboxes, if present, and record:

• Received time and subject
• Sender/caller information
• Internet Message-ID
• Whether the message exists in both mailboxes
• Whether Teams call history shows an incoming call for either user at that time

If both copies have the same Message-ID and trace events show delivery followed by forwarding, investigate Exchange forwarding. Separate voicemail messages or a call entry involving the unexpected user point toward Teams call routing.

2. Trace the voicemail through Exchange

In the Exchange admin center, go to Mail flow > Message trace > Start a trace:

1. Set the time range around the voicemail timestamp.
2. Add the originally called user and unexpected recipient.
3. If available, enter the complete Message-ID, including angle brackets.
4. Run the trace and open the message details.
5. Look for forwarding, mail-flow-rule processing, and final delivery events.

Message trace shows whether Exchange received, forwarded, rejected, or delivered a message. Forwarding and mail-flow rules can generate multiple records for the same Message-ID.^2^

Then inspect mailbox-level forwarding and all Inbox rules, including hidden rules:

Get-Mailbox -Identity [Email] |
  Format-List ForwardingAddress,ForwardingSmtpAddress,DeliverToMailboxAndForward

Get-InboxRule -Mailbox [Email] -IncludeHidden |
  Format-List Name,Enabled,RedirectTo,ForwardTo,ForwardAsAttachmentTo,Identity

A nonblank ForwardingAddress indicates forwarding to an internal recipient. DeliverToMailboxAndForward determines whether Exchange retains a copy in the original mailbox.^3^

Also review organization-wide Exchange mail-flow rules if the mailbox and Inbox-rule results are empty. Mail-flow rules can affect voicemail delivery or modify voicemail messages.^4^

3. If mailbox forwarding exists, identify who configured it

In the Microsoft Purview portal > Audit > Search:

1. Select a date range covering when forwarding might have been enabled.
2. Leave Activities blank so cmdlet-generated records are included.
3. Run the search.
4. Filter the results’ Activity column for Set-Mailbox.
5. Open each relevant record and inspect:
   • ObjectId: mailbox changed
   • Parameters: forwarding address and delivery behavior
   • UserId: user or administrator who made the change

This procedure identifies mailbox forwarding created through Set-Mailbox.^5^

Audit data is not necessarily immediate, and searchable retention depends on licensing. Audit events are typically available after 60–90 minutes for core services.^6^

4. If Exchange did not forward it, inspect Teams call routing

Run this separately for the originally called user and the unexpected recipient:

Get-CsUserCallingSettings -Identity [Email]
Get-CsUserCallingSettings -Identity [Email]

Review:

• IsForwardingEnabled, ForwardingType, and ForwardingTarget
• IsUnansweredEnabled, UnansweredTarget, and UnansweredTargetType
• Delegates and Delegators
• CallGroupTargets and GroupMembershipDetails
• BusyOnBusyOption

The cmdlet displays forwarding, simultaneous ringing, call groups, delegation, and unanswered-call settings.^7^ It requires Teams PowerShell 4.0.0 or later; BusyOnBusyOption output requires 8.0.0 or later.

You can also inspect these settings in Teams admin center > Users > Manage users > select the original user > Voice > Call answering rules.^8^

Finally, use the Teams admin center’s user troubleshooting view to locate the call around the voicemail timestamp. This can establish whether Teams recorded a call involving either user, but call telemetry alone might not prove who historically changed a forwarding setting.^9^

References

1. Set up Cloud Voicemail
2. Message trace in the Exchange admin center in Exchange Online
3. Respond to a compromised cloud email account
4. Voicemail messages aren't delivered in Teams or Skype for Business client
5. Search the audit log to investigate common support issues
6. Search the audit log
7. Get-CsUserCallingSettings-Description
8. Configure call forwarding and delegation settings
9. Monitor and troubleshoot Teams meetings and calls from the Teams admin center