Forum Discussion
Setup Alert when user creates a new inbox rule
That rule (alerting me when someone forwards their email) I created (I had to do it manually) and it is working. However a rule for creating or modifying Inbox Rules is not available from that screen when creating a new Alert. Please see my posts above with the attachments. Thanks.
Deleted Did you find a solution to the problem?
We had a user whose password and account were compromised (we've enabled mandatory 2FA since!) The attacker created an mailbox rule that deleted messages from the user's sent mail when the message contained certain words. The attacker then sent email messages containing those words.
I would like to know how to be alerted when a user creats any new mailbox rule, regardless of whether the message is forwarded to a different account.
Do you know VasilMichev or adam deltinger ?
wrtrer Yes I did. I don't know how to navigate to the one alerts page. But here is the link where you can setup a notification for an inbox fwd rule. Its not realtime however. Sometime I get the, 2-20 minutes after as rule is created.
https://protection.office.com/managealerts
- Acitivty alerts are now accessed via https://security.microsoft.com/managealerts
(Security/Microsoft Defender Admin Centre > Email & collaboration > Policies & rules > Activity Alerts)
Activitiy triggers include:
New-InboxRule Create inbox rule from Outlook Web App
Set-InboxRule Modify inbox rule from Outlook Web App
Update inbox rules from Outlook Client Thanks much for the response, WayneK ... I never got an alert when I set it up for myself.... do I need to list users individually?
My Rule Configuration
wrtrer not too sure but in your example you have three activities in your alert. I wonder if that makes them "And" and not "Or". Thus all three conditions have to be met to trigger the alert.
Try to create three custom alerts - one for each of those "activities". Then log in to your own webmail, change or create a new inbox rule and see if you get the alert. I did it without putting individual users - I did it for all users but listed individual users to receive the alerts and alerts were going to all the admins that I entered.
adam deltinger Really appreciate the quick response. Thanks.
So I see a rule for "Create mail forward/redirect rule" as an activity option, but I'm looking for a broader category: I want to know about any mail rule.
- Hmm! Not sure about this! Have to looking deeper into this! VasilMichev might know
