How does the Knox API method EmailPolicy.setAllowEmailForwarding work?

If the native email app is configured with more than one email account, the email app provides the user with an option to choose an account to use for forwarding emails. For instance, a user has configured two email accounts, E1 and E2, and receives an email on account E1. The native email app provides the user with an option to forward from either E1 (which originally received/owns the email) or E2 (not the owner of that email).

An admin can use the Knox API method setAllowEmailForwarding to turn off the email forwarding option from a specific non-owner email account. By default, the owner email account is always allowed to forward emails. This policy works only with the native Android email app.

Note that Microsoft Exchange ActiveSync email forwarding through a non-owner account may be restricted on Verizon devices.

Also, there is no API available to block the whole forwarding function even from the owner email account because the user can use the "reply" option including the email content to share the email.