A customer is running Exchange 2010 on-premises and has auto-forwarding of email messages disabled on an organizational level. After building a hybrid environment and migrating some users we found out that users were able to auto-forward email messages to external recipients.
In Office 365 auto-forward is enabled by default on an organizational level, but can be disabled on a tenant level by using Transport Rules. To achieve this, logon to the Exchange Admin Center of Office 365 (https://outlook.office365.com/ecp/) and select Rules in the Mail Flow section.
Jaap Wesselius 