Support - Office Protect

This event triggers when files are deleted manually from retention mechanisms like the recycle bin's recycle bin. Vandal hackers trying to remove fi...

Whenever an additional license is assigned to an existing account, this event will trigger. According to the "Principle of Least Privilege", u...

Whenever a license is removed from an existing account, this event will trigger. Removing user licenses is a good way for hackers to disable users.  Rem...

If an Exchange rule is created to automatically forward emails to a mailbox outside your organization, this event will trigger. This is a common method ...

Whenever someone who is not the owner accesses a mailbox, this event will trigger.   Privilege escalation is a big target for hackers. One reason is that ...

Whenever access to a mailbox is permanently granted to someone who is not the owner of the mailbox, this event will trigger.  Privilege escalation is a ...

Each time Office Protect detects a change in your Microsoft 365 configuration and automatically reapplies the setting, this alert is generated. Affected...

You will be warned of any account creation not initiated by you. From a security standpoint, creating a new account is a very common action for hackers that...

SharePoint sites can be used for data extraction and can cause data proliferation. They can also generate costs for storage usage. Therefore, we recommend a...

This event warns of any new application installed in Teams for the first time, whether it is installed org-wide, in a meeting, in a conversation, or in a sp...