Outlook rule(s) creation date

[liyy23]

Hi,

Is it possible that I can find the creation date of Outlook rules?

My colleague's email password was hacked and someone added the new rule on his Outlook, he didn't know it before but recently he got something strange, he got a lot of bounce back emails but he doesn't know the sender, then he checked the rules on Outlook and found there a rule was added on it, I assisted him to delete the rule immediately and then I told him that the email password was hacked by someone.

After that, my colleague hopes to know when to create that rule, so is it possible if there is a way that we can check the creation date of rule(s), many thanks.

Below link is good, but a guy mentioned we need to enable email log if we want to check the rule(s) creation date but not sure it works or not.

https://www.codetwo.com/admins-blog/managing-outlook-rules-powershell/

[#2]

Hi, unfortunately, this does not seem to be possible yet - there is a user voice on this feature but Microsoft did not even acknowledge it yet: https://office365.uservoice.com/forums/273493-office-365-admin/suggestions/34488787-get-inboxrule-cm...

[#3 · Accepted solution]

Hi @liyy23 

I believe what the link is referring to is the Audit Log Search in Office 365.

https://protection.office.com/unifiedauditlog

If it is not enabled, there will be a message at the top highlighting that it needs to be enabled - you can turn it on from there. Will take a couple of hours to kick in, and won't help you right now, but will in future.

If the audit is already enabled, you can search for any audit events relating to changing inbox rules.

Hope this helps,

Mark

[#4]

Thanks your info.

[#5]

Thanks HidMov,

The audit log can show the rule(s) creation activities and shows the source IP address but it didn't show the subject of rule, however, this log shows limited information about the email rules creation activities, not 100% details but at least we can check something on the log.