Forum Discussion

Copper Contributor

Oct 19, 2020

Solved

Outlook rule(s) creation date

Hi, Is it possible that I can find the creation date of Outlook rules? My colleague's email password was hacked and someone added the new rule on his Outlook, he didn't know it before but rec...

admin

office 365

security

HidMov
Oct 19, 2020
Hi liyy23

I believe what the link is referring to is the Audit Log Search in Office 365.

https://protection.office.com/unifiedauditlog

If it is not enabled, there will be a message at the top highlighting that it needs to be enabled - you can turn it on from there. Will take a couple of hours to kick in, and won't help you right now, but will in future.

If the audit is already enabled, you can search for any audit events relating to changing inbox rules.

Hope this helps,
Mark

HidMov

Iron Contributor

Oct 19, 2020

Hi liyy23

I believe what the link is referring to is the Audit Log Search in Office 365.

https://protection.office.com/unifiedauditlog

If it is not enabled, there will be a message at the top highlighting that it needs to be enabled - you can turn it on from there. Will take a couple of hours to kick in, and won't help you right now, but will in future.

If the audit is already enabled, you can search for any audit events relating to changing inbox rules.

Hope this helps,

Mark

liyy23
Copper Contributor
Oct 20, 2020
Thanks HidMov,

The audit log can show the rule(s) creation activities and shows the source IP address but it didn't show the subject of rule, however, this log shows limited information about the email rules creation activities, not 100% details but at least we can check something on the log.