Go to the Exchange admin center, expand the Mail flow menu on the left navigation pane, and click on Rules.

Click the + Add a rule button and select Create a new rule from the dropdown menu. Name it something clear, like "External Email Admin Approval".

Under Apply this rule if, set the conditions to target external domains:

• Select The sender -> is internal/external -> choose Inside the organization.

• Click the + icon to add a second condition.

• Select The recipient -> is internal/external -> choose Outside the organization.

Under Do the following, define what happens to the email:

• Select Redirect the message to -> require moderator approval.

• Choose one or more specific approvers (e.g., your admin group or a specific manager).

Click Next, leave the default settings for the rule properties, and click Save. Once saved, click on the rule in the list and toggle its status to Enabled.

Open the Google Admin console, go to Apps -> Google Workspace -> Gmail, and scroll down to select Routing.

Scroll to the Routing section and click Configure (or Add Another Rule if you already have existing routing rules). Name it "Outbound External Approval".

Under Messages to affect, check the box for Outbound only.

Scroll down to Envelope filter:

• Check Only affect specific envelope senders -> select Pattern match -> enter your domain regex (e.g., .*yourcompany\.com).

• Check Only affect specific envelope recipients -> select Unrecognized addresses (this automatically targets any domain not verified in your Google Workspace).

Under For the above types of messages, change the dropdown from Modify message to Require admin approval. You can also choose to specify an alternative approver or custom rejection message if denied. Click Save.