How can I set alert to get alertWhen for Example 100 users receive an email from on sender?

Highlighted
Occasional Visitor

I wanted to know if there is a way to set a rule on admin center to be informed how many people have received an email from a sender, it can help me to detect some phishing emails that have not been detected by protection rules.

 

1 Reply
Highlighted

Well, any sort or rule will not apply retroactively, as in it will not flag any messages that were already received. Use the Search-Mailbox cmdlet to locate such messages, or perform an eDiscovery search.