Managed Sentinel – Alert 120
| Alert ID | MS-A120 |
| Alert Name | Office 365 Mailbox Added or Removed |
| Description | This alert identifies administrative operations for mailbox creation and removal. This is an operational alert. |
| Severity Level | Informational |
| Threat Indicator | |
| MITRE ATT&CK Tactics | |
| Log sources | Office 365 |
| False Positive | |
| Recommendations | 1. Review the list of O365 email accounts and confirm that these users are not longer part of your organization (delete) or these are unrecognized users for your organization (add) |