Find the rule behind the missing email.
Monitor new and modified Microsoft 365 inbox rules that delete messages, move them out of sight or forward them outside the organisation.
Mailbox rules are useful. They are also worth checking when a user reports missing messages or an account behaves unexpectedly. A rule that moves replies away from the inbox can be just as relevant to an investigation as one that forwards mail.
Delete.
Move.
Forward.
Start with the rule actions that matter to the investigation: deletion, movement out of the inbox and forwarding outside the organisation.
Alert when an inbox rule is created or changed
Start with the rule actions that matter to the investigation: deletion, movement out of the inbox and forwarding outside the organisation. Review the account and the rule together before deciding what to change.
Changes worth reviewing
New rules that automatically delete incoming messages.
Rules that move or hide messages in another folder.
Forwarding to an address outside the organisation.
Changes to an existing rule’s conditions or actions.
Review the rule in context
A rule change is a reason to investigate, rather than a verdict. Your engineers can review the account’s other activity, check whether the user recognises the change and decide what to do next.
Useful for customer mailbox investigations
For an MSP, a consistent review process matters across tenants. Vigil Alerts gives the team a shared workflow for reviewing mailbox signals without automatically changing customer accounts.
Can Vigil Alerts remove a suspicious rule?
No. Vigil Alerts monitors and alerts. Any rule removal or account recovery remains an engineer’s decision and is carried out through your usual Microsoft 365 administration process.
Does Microsoft 365 already provide forwarding alerts?
Microsoft documents built-in and configurable alert policies, including a policy for creation of forwarding or redirect rules. Which policies and settings are available depends on your subscription and configuration. Review what you already have before buying another tool.
Vigil offers a focused monitoring and review workflow across the tenants you onboard, with self-hosted and dedicated hosted options. It is not a claim that Microsoft lacks alerting or that Vigil always alerts sooner.
Reference: Microsoft Defender alert policies, reviewed 18 October 2026.
Already investigating a compromised account?
Start with the recovery checklist, then record what you find.