The Exchange Admin Behavior Anomaly Detector

Daniel Miller@dxmiller

•updated Feb 2, 2026•10•0•83

This query uses the Machine Learning series_decompose_anomalies function to build a baseline of "normal" transport rule modification behavior. If your organization typically changes 0 rules a week, and suddenly 5 are changed at 2 AM on a Saturday, this query will catch it regardless of what the parameters are.