Thousands of Sent Items moved to Deleted Items, no rules, no retention

he audit evidence confirms an owner-context move, but LogonType 0 does not identify the human action or exact client. ClientInfoString, ClientIPAddress, SessionId, LogonUserSid, and timestamps are the fields that can narrow it down. Export the full audit records for the three-hour window, group them by session and client IP, and compare those values with Microsoft Entra sign-in logs. The MacOutlook value indicates an Outlook service path, not conclusively a Mac user gesture. Temporarily remove the mailbox from iOS and Mac clients one at a time and check whether new move events stop. Preserve and restore the affected messages from Deleted Items before further testing. If any sign-in is unfamiliar, reset the password and revoke sessions immediately. Check Microsoft 365 service health. With rules, retention, delegates, and transport already excluded, Microsoft Support will need the exported audit JSON, timestamps, tenant, mailbox, and session identifiers to determine the server-side origin.