Managed Sentinel – Alert 120

Alert IDMS-A120
Alert NameOffice 365 Mailbox Added or Removed
DescriptionThis alert identifies administrative operations for mailbox creation and removal. This is an operational alert.
Severity LevelInformational
Threat Indicator
MITRE ATT&CK Tactics
Log sourcesOffice 365
False Positive
Recommendations1. Review the list of O365 email accounts and confirm that these users are not longer part of your organization (delete) or these are unrecognized users for your organization (add)