Forum Discussion
Setup Alert when user creates a new inbox rule
Hi,
I am looking for an way to setup a new Office 365 Alert that would send me an email when a user creates a new inbox rule. I have looked at tech articles and have created them via manage alerts, but they don't seem to be working as I never get the email notification.
20 Replies
- How were the test rules created? If the rules were created on the Outlook desktop client, the alerts won't be triggered. The alert is designed to monitor rules created in OWA.
Deleted There was a menu in Security Center under Alerts section - that menu was "Manage Advanced Alerts" but it's no longer there
but you can still access it if you go directly to https://protection.office.com/managealerts. That's where you can create an alert you need. Click on "New Alert Policy". When creating an alert there for activity search for "New-InboxRule", you will find it there - see pictures from my setup.
- Acitivty alerts are now accessed via https://security.microsoft.com/managealerts
(Security/Microsoft Defender Admin Centre > Email & collaboration > Policies & rules > Activity Alerts)
Activitiy triggers include:
New-InboxRule Create inbox rule from Outlook Web App
Set-InboxRule Modify inbox rule from Outlook Web App
Update inbox rules from Outlook Client
You should have such alert created by default, look for it in the SCC under Alert policies: https://protection.office.com/#/alertpolicies
Deleted Did you find a solution to the problem?
We had a user whose password and account were compromised (we've enabled mandatory 2FA since!) The attacker created an mailbox rule that deleted messages from the user's sent mail when the message contained certain words. The attacker then sent email messages containing those words.
I would like to know how to be alerted when a user creats any new mailbox rule, regardless of whether the message is forwarded to a different account.
Do you know VasilMichev or adam deltinger ?
- Do you receive any alert mails from other triggers?
- It should be through alert policy’s in the security and compliance center!
Adam
