Microsoft 365 email security for small teams
Inbox rules, forwarding, audit-log blind spots, and how InboxGuards reads supported Microsoft 365 events — an alarm for small teams, not a replacement for Microsoft security.
How Microsoft 365 accounts show up in email fraud
Business email compromise can begin with stolen credentials, malicious app consent, or impersonation. A compromised Microsoft 365 account may be used to create inbox rules, configure forwarding, or send deceptive payment requests that look like a normal vendor thread. These techniques do not always produce the same records, and provider ingestion can be delayed. Monitoring is one control within a broader email-security and payment-verification process — not a replacement for Microsoft 365 Defender, Purview, or your admin team.
Audit-log blind spots small teams hit
Microsoft 365 may record supported actions in its audit services. An audit record alone is not a response process. Most small businesses do not assign someone to search Unified Audit Log every morning for New-InboxRule, unexpected UserLoggedIn locations, or external forwarding. InboxGuards checks available records at the fastest cadence available on standard Microsoft 365 plans — no premium security licensing required — and notifies you when a configured detection rule matches. Provider ingestion delays still apply.
Inbox rules, forwarding, and lookalike risk
Classic BEC persistence on Microsoft 365 includes inbox rules that hide or redirect mail and forwarding to an external address. InboxGuards reviews those supported signals when Microsoft exposes them. Lookalike domains and weak SPF, DKIM, and DMARC are a separate impersonation path that does not require logging into your tenant — use DNS hygiene and out-of-band payment checks alongside any alarm.
- Sign-ins from new or unexpected countries and IP addresses
- New inbox rules that delete, hide, or forward mail
- Mail forwarding turned on to an external address
- New admin roles or app permissions granted without your knowledge
- MFA or audit logging being switched off
- Impossible travel, dormant accounts waking up, and risky after-hours changes
- Departure Watch for accounts marked as leaving
What standard Microsoft 365 already gives you
Business Basic and Business Standard already include admin centers, audit capabilities that depend on workload and configuration, and security defaults options. Higher Microsoft licenses can unlock additional Identity Protection and MFA reporting surfaces. InboxGuards marks licensed-only posture items unavailable instead of guessing when a tenant lacks Entra ID P1 or P2. We do not claim to replace Microsoft security stack. We read supported audit events so a small team gets plain-English alerts for configured account-takeover patterns.
Daily posture and dark-web checks — still not a SOC
InboxGuards also runs a daily posture check on supported tenant data such as Microsoft security defaults and older guest accounts, and — when the tenant is licensed for Entra ID P1 or P2 — Microsoft per-user MFA enrollment report and Identity Protection risky-sign-in records. On plans that do not expose those last two, the dashboard marks them unavailable instead of inventing coverage.
Separately, once a day InboxGuards reads user email addresses from your directory with read-only access and checks each one against Have I Been Pwned and LeakCheck for credential leaks, including info-stealer logs. Leaked password values themselves are never stored or shown. That is still automated monitoring and alerting — not a human SOC watching your tenant overnight.
How InboxGuards monitors Microsoft 365
InboxGuards connects to your Microsoft 365 tenant with read-only access to supported audit records — it does not request mailbox-content access and cannot change tenant settings. When a configured rule matches, you get a plain-English alert describing the available evidence and general response guidance. Monitoring costs $2 per user per month with no minimum and a 30-day money-back guarantee. Hands-on remediation is not included; an optional $199 flat-fee remediation can be separately authorized. Start monitoring or see pricing.