Forum Discussion

  • Your best bet is to make sure mailbox auditing is enabled, have E5 licenses so it includes the Send event and then crawl the unified audit log periodically to trigger alerts as needed.

Resources