How to Investigate a Security Alert for a New Email Delegation Rule

A new mailbox delegation or forwarding rule may be legitimate coverage or an attempt to access business messages. It can persist independently of password changes.

What to check

Review rule creator, delegate or recipient, scope, approval, creation time, mailbox activity, sign-ins, and provider audit records. Confirm whether messages were read, sent, or forwarded.

Recommended next step

Remove unauthorized access, revoke sessions if needed, and preserve evidence for impact assessment. For approved rules, document the owner and expiry and monitor access.

How Informatix Systems can help

Informatix Systems provides security operations and email security services. We can assess the affected environment, trace the issue, and help plan a practical improvement. Contact us with the system involved, when the issue began, and non-sensitive error details.