Low-severity alert

Question

I have for one of our users an alert. Interestingly it is that the affected colleague to whose post office it concerns does not have created a rule and also the gMail address given there does not know. I have checked the account in the admin portal from Office 365 and see no such rule. Even the user has no rule with this entry in his mailbox. :(

Is this maybe hidden? How and where can I see and remove this rule? I want to be sure that no emails will be forwarded without us knowing about it.

[
  {
    "Name": "AlwaysDeleteOutlookRulesBlob",
    "Value": "False"
  },
  {
    "Name": "Force",
    "Value": "False"
  },
  {
    "Name": "RedirectTo",
    "Value": "******@gmail.com"
  },
  {
    "Name": "Name",
    "Value": "Text is here changed from myside :) "
  },
  {
    "Name": "SubjectOrBodyContainsWords",
    "Value": "payment;invoice"
  },
  {
    "Name": "StopProcessingRules",
    "Value": "True"
  }
]

Answer 1

Hello Wmloewe,

Thanks for your reply. We'd like to collect that entire entry to check it on our side. For privacy concern, we will send you a private message to collect it.

Regards,

Rudy

Answer 2

Hello Wmloewe,

Thanks for posting here.

For the global admin, we can use the following PowerShell cmdlets to check the end users' inbox rules:

1. Connect to Exchange online.
2. Get-InboxRule -Mailbox ******@Contoso.com

Please see here to get the detailed information. After find that inbox rule, use the Remove-InboxRule cmdlet to remove an Inbox rule.

Hope the above information helpful.

Regards,

Rudy

Answer 3

Many thanks for your response. I see all the rules that have been made, and they all seem to be OK. But all rules are that the mails are moved to subfolders and none that forward something or automatically answer. I find in no way this email address for which Microsoft has reported the alert.

Answer 4

Many thanks for your response. I see all the rules that have been made, and they all seem to be OK. But all rules are that the mails are moved to subfolders and none that forward something or automatically answer. I find in no way this email address or rule for which Microsoft has reported the alert.

Answer 5

Hello Wmloewe,

Have you referred to my reply? Please take your time.

Regards,

Rudy