New inbox rules on a director’s account gave IT a reason to act.
Vigil Alerts flagged unusual activity on a Binn Group director’s Microsoft 365 account, including newly added inbox rules. The finding enabled the IT team to carry out a full account reset.
Mailbox changes came into view
The activity involved a director’s account. Alongside the unusual account activity, Vigil Alerts flagged user inbox rules that had been added, bringing those mailbox changes to the attention of IT.
IT took control of the response
With the activity identified, the IT team was able to reset the account fully. Vigil Alerts provided monitoring and alerts; the account reset was carried out by IT.
Why inbox rule monitoring belongs in the review
Rules can change what a mailbox user sees and how messages are handled. New or modified rules are therefore useful evidence when an account behaves unexpectedly.
This case describes added rules. It does not establish that those particular rules forwarded, deleted or hid messages, or that data was lost.
Monitor the changes affecting your users
Vigil Alerts brings inbox rule and account activity into a review workflow for engineers, with a choice of self-hosting or dedicated hosting.