Office SCC - expired email forwarding alerts

[icelava]

Office Security & Compliance Center's alerts generally become useless past a week since the details for the alerts necessary to make informed assessments and judgements get discarded thereafter.

For alerts about users creating email forwarding rules (not wholesale mailbox forwarding), are there alternative ways to track back these details? Short of directly signing in as said user, like what Microsoft 365 security recommends.

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/responding-to-a-compromi...

[#2]

Which details do you mean in particular? You can enumerate rules within user's mailboxes via PowerShell or EWS, and toggle them on/off as needed. To ensure timely discovery, you can configure email notifications for said alerts. The unified audit log will surface any events related to configuring forwarding, and the message trace can give you a clue as to whether forwarding is actually taking place.

[#3 · Accepted solution]

@Vasil Michev 

When attempting to [View activity list] and looking at the activity items.

I installed the Exchange Online PowerShell Module and was able to see the forwarding rules with Get-InboxRule cmdlet.

Thanks