Unusual Mailbox or Folder Access in Office 365_V_1

Mehulkumar Savajani@Msavajani

•updated Jan 20, 2026•47•6•404

This rule detects suspicious activity related to mailbox access within Office 365. It has two main parts: 1) Identifies users accessing a high number of unique mailboxes belonging to other users. 2) Identifies users accessing a high number of unique folders within another user's mailbox. Both scenarios can indicate unauthorized access, data exfiltration attempts, or compromised accounts.