Office 365

role_member_added

Records Azure Active Directory role assignment operations, particularly additions to privileged roles like Global Administrator, which represent privilege escalation and potential security risks

inbox_rule_created

Records New-InboxRule operations where users create email forwarding rules, often with external forwarding to bypass administrator controls and exfiltrate sensitive data

mailbox_forwarding

Records Set-Mailbox operations that configure external email forwarding, a common data exfiltration technique where emails are automatically forwarded to external addresses

mailbox_permission_added

Records Add-MailboxPermission operations that grant mailbox access rights (FullAccess, SendAs, SendOnBehalf) to other users, providing persistent access that survives password resets

anonymous_link_created

Records SharePoint Online anonymous link creation events where users create publicly accessible sharing links for files or folders, enabling external access without authentication