How InboxGuards works, step by step

InboxGuards is not a real-time stream. It schedules checks of supported audit records at the fastest cadence available on standard Microsoft 365 and Google Workspace plans — no premium security licensing required — and matches them against a fixed set of account-takeover signals. Provider ingestion delays and API coverage still apply.

• ■Suspicious sign-ins — a new IP for an account, impossible travel between two sign-ins, a device type never seen on that account (Microsoft 365 only: Google's sign-in records do not include device or browser details), an account waking up after 30+ days dormant, and repeated failed sign-ins followed by a success.
• ■Sneaky inbox rules — rules that forward, redirect, or delete mail, hide it in folders like RSS Feeds or Conversation History, or filter on invoice / wire / payment keywords. Mailbox-level auto-forwarding is flagged separately.
• ■Permission and delegation changes — new mailbox delegates, Send-As rights, admin role grants, and OAuth app consents that survive a password reset.
• ■Password resets and authentication changes — admin password resets, MFA methods added or deleted, per-user MFA disabled, Conditional Access or Security Defaults changed.
• ■Tenant tampering and data movement — mail-flow rules and connectors, audit logging turned off, mailbox exports and content searches, mass permanent deletion, Power Automate flows that touch email, and anonymous SharePoint/OneDrive links.
• ■Slower watches — a daily dark-web check of every directory address against Have I Been Pwned and LeakCheck, DMARC aggregate-report collection for a domain you set, a weekly public-DNS lookup for lookalike domains, and Departure Watch, which raises data movement by listed leaving accounts to critical.

When a configured rule matches, you get an alert describing the available evidence in plain English, with general response steps for that kind of finding. Alerts go out by email (and Slack, if connected); everything is timestamped and kept in your dashboard with a response-status trail your team can document.

You own the alerts. Your authorized administrator or MSP reviews the finding, decides the response, and performs any tenant changes. Monitoring does not remediate. An optional, separately authorized $199 hands-on remediation service exists if you request it from the dashboard; it is never included in the monitoring price and never automatic. Alerts, monitor-run history, monthly scorecards, and downloadable reports document the monitoring for your own records, your insurer, or your advisers.