Low-severity alert

Question

Received an alert this morning that a forwarding address was added to one of my mailboxes.  There's plenty of information in the audit log.  But, I don't know how something like this could have happened.  Has anyone seen something like this before?  Do you have any advice on preventing this from happening?  Here are the details (sanitized for your protection):

Date:2018-11-29 11:15:52

IP address:2xx.1xx.3x.2x:1xxxx9

User:******@4xx.com

Activity:Set-Mailbox

Item:Some Guy

Detail:

More information

ClientIP:2xx.1xx.3x.2x:1xxx9

CreationTime:2018-11-29T17:15:52

ExternalAccess:false

Id:8xxxxxxb1-9xx8-4xxxfa-exxxc-0xxxxxxxx0d4

ObjectId:Some Guy

Operation:Set-Mailbox

OrganizationId:6xxxxxxx02-8xxc-4xxxd-8xxxf-b0xxxxxxxx8e

OrganizationName:someclient.onmicrosoft.com

OriginatingServer:BN6PR22MB1681 (15.2x.1xx1.0x7)

RecordType:1

ResultStatus:True

SessionId:70xxx31ef-3bxxf-4x7-aex-d7xxxxx8efc6a

UserId:someguy@4****

UserKey:10037FFEA8C95363

UserType:2

Version:1

Workload:Exchange

[ { "Name": "Identity", "Value": "NAMPR08A007.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/someclient.onmicrosoft.com/Some Guy" }, { "Name": "ForwardingSmtpAddress", "Value": "smtp:******@gmail.com" } ]

Answer 1

Hi Brownr0127,

Thank you for posting. However, it seems that this is default alert policy “Creation of forwarding/redirect rule” which generates an alert when someone in your organization creates an inbox rule for their mailbox that forwards or redirects messages to another email account. This policy only tracks inbox rules that are created using Outlook Web App or Exchange Online PowerShell. This policy has a Low severity setting.

On the Security & Compliance Center under Alert policies page, the name of the built-in policies are in bold and the policy type is defined as System. These policies are turned on by default. You can turn these policies off (or back on again), set up a list of recipients to send email notifications to, and set a daily notification limit. The other settings for these policies can't be edited.

For detailed information, please refer to the article: Alert policies in the Office 365 Security & Compliance Center

Best regards,

Shyamal

Answer 2

Hi Brownr0127,

I'm writing to follow up on this thread. If you have any further questions, please do not hesitate to contact us.

Best regards,

Shyamal