Answers 'is someone else in my mailbox?' for a Microsoft 365 account: hidden or new forwarding rules, mailbox-level auto-forwarding, delegates and Send As permissions, app consents, sign-ins from new places, connected devices, and the tell-tale rules attackers leave behind, with a clean-up checklist and an evidence report.
Business e-mail compromise usually starts quietly: a phished password, then a forwarding rule or a hidden rule that deletes replies, then a changed bank account on an invoice. The signs are spread across Outlook, the Microsoft 365 admin centre, Entra sign-in logs and PowerShell, and most small businesses have no one who looks. Microsoft's own detection lives in Defender plans the business does not have.
Bookkeeper
A customer paid a fake invoice. The check finds a rule moving the customer's replies to RSS Feeds, a sign-in from another continent and a consent to an unknown mail app; the clean-up and the evidence pack take twenty minutes.
MSP technician
Fifty client mailboxes scanned on the first of the month; two new forwarding rules found and removed before anyone lost money.
Solicitor
After a convincing phishing page, the scan shows no rules or sign-ins yet; the password reset and session revoke close the door anyway.
Sign-in history and risk detections depend on the tenant's licences: the free Entra tier keeps seven days of sign-ins, and risky sign-in detail needs Entra ID P2. Mailbox auditing must be on to see what an attacker read. An administrator role is needed for the tenant-wide version. The check finds the common patterns; a careful attacker can avoid them, which is why the scheduled re-check exists.
Outlook & Microsoft 365
Every rule in every mailbox in one place, server-side and client-only, including the hidden ones Outlook never shows, each one verified.
System & diagnostics
Printers that work and printing that costs less.
Outlook & Microsoft 365
Fixes the Outlook that will not start, keeps asking for a password, hangs on 'Loading profile', loses search, or takes a minute to open.
Mailbox Compromise Check is planned for a later release. Leave your e-mail address and we will write once when it becomes available. We ask you to confirm your address first, and you can unsubscribe at any time.
Questions now? Contact our team.