Overview

This pack flags high-risk Microsoft 365 (M365) Unified Audit Log events: mail-forwarding rules, delegation, and role changes.

What this pack does:

• Flags external forwarding
• Flags role escalations
• Drops routine successes