Inbox Protection
Most account takeovers do not end with a stolen password. They end with a quiet inbox rule. Once an attacker is in a mailbox, the first thing they usually do is create an Outlook rule that forwards incoming mail to an address they control, then deletes or marks it read so the real owner never notices. This is the engine of Business Email Compromise (BEC): invoice fraud, wire redirection, and payroll diversion all run on a rule the victim cannot see.
Inbox Protection reads the inbox rules of every mailbox in your tenant and flags the ones that match this pattern, so a malicious rule surfaces on your dashboard instead of in your accounts-payable ledger.
Requires a paid plan
Inbox Protection is included with paid plans. Without a paid plan the page shows an upgrade prompt instead of results. See the plans page for what each plan includes.
Mailbox consent is required
Inbox Protection reads inbox rules with the MailboxSettings.Read Microsoft Graph permission. This is a mailbox-scoped read permission that is granted separately from the rest of the scanner. If your tenant has not granted it yet, the scan completes with a "Mailbox access needs consent" prompt and no results. Re-run admin consent from the Connect page to enable mailbox scanning. Consent is verified by the scan actually reading a mailbox, never assumed.
What it checks
Inbox Protection assesses every actionable inbox rule (rules that forward, redirect, move, or delete mail) against the heuristics below. Benign rules that only categorise or flag mail are ignored. Each flagged rule appears in the inventory with its mailbox, its risk level, and a short set of action badges.
External forwarding
A rule that forwards, redirects, or forwards-as-attachment to an address outside your verified domains. This is the primary BEC exfiltration method: every incoming message is quietly copied to the attacker. A forwarding rule that also hides mail or targets finance keywords is escalated to Critical, because that is the complete "steal and conceal" pattern.
Remediation. Confirm the mailbox owner created the rule. If it is unexpected, delete it, reset the account's password and sign-in sessions, and review the sign-in logs for how the account was accessed.
Internal forwarding
A forwarding or redirect rule whose targets are all inside your own domains. This is low risk and often legitimate (delegation, shared workflows), but it is surfaced so you can confirm it is intentional.
Hidden rules
A rule that marks incoming mail as read and then deletes it or moves it out of the inbox. Hiding replies is how an attacker keeps a compromised mailbox looking normal while they run a fraud in its name.
Remediation. Verify the rule is legitimate. If not, remove it and investigate the account for compromise.
Finance-keyword rules
A rule whose conditions match finance terms (invoice, payment, wire, SWIFT, IBAN, remittance, and similar) and then move, delete, or forward the message. This is the signature of invoice-fraud staging: the attacker silences exactly the threads a victim would use to notice a redirected payment.
Remediation. Confirm the mailbox owner deliberately created a rule that acts on finance mail. If not, remove it and treat the mailbox as potentially compromised.
Auto-delete rules
A rule that permanently deletes matching mail (bypassing Deleted Items). Hard delete can be used to destroy evidence of an intrusion. It is flagged so you can confirm it is intentional.
Forwarding fan-out
A tenant-wide signal: the same external address is the forwarding target of inbox rules in three or more mailboxes. A single external collector across many mailboxes is a strong indicator of a wider compromise, not a one-off.
Remediation. Remove the rules, reset the affected accounts, and block the collecting address.
Reading the results
The summary chips count the flagged rules, how many forward externally, how many hide mail, how many target finance keywords, and how many mailboxes are affected. The table lists each flagged rule with its mailbox, name, risk level, and action badges; selecting a row opens the full detail, including the exact forwarding targets (external ones are marked), the keywords the rule matches, and the findings raised for that mailbox.
Because the findings are written per mailbox, a mailbox that newly acquires a suspicious rule shows up in your drift alerts as a new finding, so you are notified the moment a rule appears rather than only when you next open the page.
Scope and limitations
Inbox Protection covers Outlook inbox rules only (messageRules), which is where rule-based forwarding, redirecting, hiding, and deleting live, and which is the dominant BEC vector.
Two related forwarding mechanisms are not covered in this phase, because Microsoft Graph does not expose them:
- Mailbox-level SMTP forwarding (
ForwardingSmtpAddress/DeliverToMailboxAndForward) is an Exchange Online setting, readable only through Exchange administration, not Graph. - Exchange transport rules (organisation-wide mail-flow rules) are likewise Exchange-only.
Reading those requires broader Exchange administrative access than the mailbox read permission Inbox Protection uses, and is planned for a later phase. Inbox Protection never reports forwarding it cannot actually read.