M365 Suspicious Mailbox Search and Access Activity

Kaung Khant Ko@kaungkhantko

•updated Aug 10, 2026•1•0•10

Detects anomalous mailbox activity in Microsoft 365 where a user account performs both search operations and mail item access, particularly when the activity originates from multiple IP addresses or exceeds a threshold of mail items accessed within a one-hour window. This behavior often indicates potential mailbox compromise or unauthorized data collection.