Office Protect Settings - Enable Client Rules Forwarding Block
This Security Control will create a transport rule in Exchange that will prevent users from creating forwarding rules to an external email address. It will reject the messages auto-forwarded with the following message: 'External Mail Forwarding via Client Rules is not permitted'.
You can find transport rules in the Exchange Admin Center, in the Mail Flow section, the transport rule will be named "Block Auto-Forwarding to External Domains (OP)"
Operation to look for in the Unified Audit Logs: Set-TransportRule
Microsoft’s documentation on Transport Rules : https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules