Forum Discussion
Setup Alert when user creates a new inbox rule
You should have such alert created by default, look for it in the SCC under Alert policies: https://protection.office.com/#/alertpolicies
That rule (alerting me when someone forwards their email) I created (I had to do it manually) and it is working. However a rule for creating or modifying Inbox Rules is not available from that screen when creating a new Alert. Please see my posts above with the attachments. Thanks.
Deleted Did you find a solution to the problem?
We had a user whose password and account were compromised (we've enabled mandatory 2FA since!) The attacker created an mailbox rule that deleted messages from the user's sent mail when the message contained certain words. The attacker then sent email messages containing those words.
I would like to know how to be alerted when a user creats any new mailbox rule, regardless of whether the message is forwarded to a different account.
Do you know VasilMichev or adam deltinger ?
wrtrer Yes I did. I don't know how to navigate to the one alerts page. But here is the link where you can setup a notification for an inbox fwd rule. Its not realtime however. Sometime I get the, 2-20 minutes after as rule is created.
https://protection.office.com/managealerts
- Acitivty alerts are now accessed via https://security.microsoft.com/managealerts
(Security/Microsoft Defender Admin Centre > Email & collaboration > Policies & rules > Activity Alerts)
Activitiy triggers include:
New-InboxRule Create inbox rule from Outlook Web App
Set-InboxRule Modify inbox rule from Outlook Web App
Update inbox rules from Outlook Client
adam deltinger Really appreciate the quick response. Thanks.
So I see a rule for "Create mail forward/redirect rule" as an activity option, but I'm looking for a broader category: I want to know about any mail rule.
Question, I have an alert setup that notify's me when a user logs in, and those are working although they seems to be delayed by several hours. Just thinking, maybe it has to do with my Office 365 plan? We are on Business Premium, or do I need an E3? And can I buy one E3 license just for me and then have that alert available?
Alerts are not real-time, changing the SKU wont help you with that. It will help you with the missing "templates" though, as some of those are targeted to the premium SKUs.
Just wanted to close the loop on this post. My alerts are working all the sudden. I do wish they were in real time however.
