How to View Users' Inbox Rules in Exchange Online

Managing inbox rules for a shared mailbox is crucial for maintaining security and efficient workflow in Microsoft 365. Shared mailboxes are often used by various teams like sales, support, HR, etc., and they rely heavily on mailbox rules to handle emails consistently. So, it is essential to monitor and manage inbox rules on shared mailboxes.

It's important to regularly review the inbox rules for all shared mailboxes. This helps to identify any unauthorized or suspicious rule creations. Use the following PowerShell cmdlet to retrieve all inbox rules for shared mailboxes.

Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails SharedMailbox | ForEach-Object {
$mailbox = $_.PrimarySmtpAddress
Get-InboxRule -Mailbox $mailbox | Select-Object @{Name="Mailbox";Expression={$mailbox}}, Name, Description  } 

This cmdlet will list all inbox rules for each shared mailbox, providing a clear overview for administrators.

Creating inbox rules can help manage emails efficiently. For example, you might want to flag emails of particular email types or from specific senders in shared mailboxes. Use the following cmdlet to create a new inbox rule in a shared mailbox after replacing SharedMailboxName with your shared mailbox name.

New-InboxRule "CheckActionRequired" -MyNameInToBox $true -FlaggedForAction Any -MarkImportance "High" -Mailbox "<SharedMailboxName>"

This rule flags any email where your name is in the To box and marks it as high importance. You can also create custom inbox rules using PowerShell as per your needs.

Sometimes, you may need to modify existing rules in a shared mailbox to better suit your needs. For instance, you might want to change the importance of flagged emails. Use the following cmdlet to modify a rule.

Set-InboxRule "CheckActionRequired" -MarkImportance "Low" -Mailbox "<SharedMailboxName>" 

Ensure to replace SharedMailboxName with your shared mailbox name before execution. This cmdlet changes the importance of the "CheckActionRequired" rule from high to low. Additionally, you can modify inbox rules based on various parameters using PowerShell.

To maintain security and efficiency, it's crucial to remove unnecessary or harmful rules that users might have created. Use the following cmdlet to remove an inbox rule.

Remove-InboxRule "CheckActionRequired" -Mailbox "<SharedMailboxName>" 

This cmdlet deletes the "CheckActionRequired" rule from the specified mailbox. You can also delete inbox rules using PowerShell based on various parameters.

By regularly monitoring inbox rules for shared mailboxes, Microsoft 365 admins can ensure secure and efficient email management. However, relying solely on PowerShell for managing inbox rules can be challenging, as it requires knowledge of scripting and may not offer a user-friendly interface.

• With the "Shared Mailboxes with Inbox Rules" report, admins can monitor all the inbox rules set up across the shared mailboxes in one place, simplifying the process and securing the email environment.

Monitoring mailboxes with forwarding rules is crucial for admins to prevent data leaks and unauthorized access. For example, an employee might set up a rule to forward emails containing sensitive data to an external personal account, which poses a significant security risk. Once a mailbox with suspicious forwarding rules is identified, admins can review and remove these rules or prevent the user from setting such rules.

To view all the mailboxes having forwarding rules in your Microsoft 365, use the following PowerShell script.

$mailboxes = Get-Mailbox -ResultSize Unlimited
$forwardingMailboxes = @()
foreach ($mailbox in $mailboxes) { 
  $rules = Get-InboxRule -Mailbox $mailbox.Alias
  foreach ($rule in $rules) { 
    if ($rule.ForwardTo -or $rule.ForwardAsAttachmentTo) { 
       $forwardingMailboxes += [PSCustomObject]@{ 
          Mailbox       = $mailbox.Alias
          RuleName      = $rule.Name
          ForwardTo     = $rule.ForwardTo -join ", "
          ForwardAsAttachmentTo = $rule.ForwardAsAttachmentTo -join ", "
            }
         }
     }
}
$forwardingMailboxes | Format-Table -AutoSize

While using PowerShell scripts to monitor forwarding rules is effective, it can be time-consuming. This method also needs to be run periodically, making it tedious.

• The Mailbox with Forwarding Inbox Rules report provided by AdminDroid makes it easy to identify email forwarding rules in user mailboxes.
• This in-depth report provides valuable insights into which mailboxes have forwarding enabled with other key details, aiding in tracking misconfigured rules.

Suspicious inbox forwarding rules pose significant security risks, as attackers often use them in Business Email Compromise (BEC) attacks. By setting up forwarding rules, attackers can automatically send copies of incoming emails to external addresses, allowing them to intercept sensitive information without detection. This makes it crucial to create alerts for the creation of forwarding rules in Microsoft 365 to promptly identify and mitigate these threats.

Here are the steps to create an alert for forwarding rules in Microsoft 365 Defender:

By following these steps, you can effectively create alerts for forwarding rules in Microsoft 365, enhancing your organization's ability to detect and respond to potential security threats promptly. However, these alerts are general and do not specify whether the forwarding rules are set to external or internal addresses. Determining this requires a thorough investigation of each rule, which can be tedious.

To effectively keep track of external forwarding rules, AdminDroid provides a report on Inbox Rule Configuration Changes with External Forwarding under Exchange Analytics. These reports offer detailed insights like event time, user who created, rule name, forwarding addresses, etc.

You can set up alert polices to notify you when an external forwarding inbox rule is created, in just a few clicks.

Tracking inbox rules removed by users in Microsoft 365 is crucial for various reasons:

In Microsoft 365, traditional methods for monitoring user-removed inbox rules have been deprecated. This has made it cumbersome for admins to track these changes, as there is currently no convenient built-in way to generate reports on removed inbox rules by users. The lack of straightforward tracking increases the risk of missing critical security and compliance issues.

• AdminDroid's audit reports not only showcase the rules removed by users but also include all rule operations performed by users, such as enabling and disabling rules.
• Navigate to Analytics»Exchange Analytics»Inbox Rule Audit in AdminDroid.
• Go to the Other Operations to access the Enabled/Disabled/Removed Inbox Rule Changes report.

In addition, AdminDroid provides granular details of every inbox rule and configuration in easily digestible charts and graphs. This comprehensive approach ensures admins have full visibility into inbox rule changes, enhancing security, compliance, and user accountability.

Have you heard of Outlook rules attacks? These attacks involve cybercriminals exploiting the rules feature to automate malicious actions such as deleting or exfiltrating sensitive emails. This can happen without the user's knowledge, making the attack hard to detect and allowing continued unauthorized access.

Given these risks, it's crucial to prevent compromised or suspicious users from creating harmful rules. While inbox rule creations can be disabled for all Outlook Web App users via the global setting OWAMailboxPolicy-Default, this might not be a viable option. So, let's walk through how to disable inbox rule options for a particular user in Microsoft 365:

Now apply this policy to the suspicious user using PowerShell:

Set-CASMailbox -Identity "<UPN>" -OWAMailboxPolicy "<PolicyName>" 

Once inbox rules are disabled for a user, they will no longer be able to create, manage, or access any rules. Additionally, any rules that were already created will also be inaccessible and cannot be modified by the user.