Exchange.ManageAsApp
— application permission, granted to the app registration with admin consent.
Endpoints:
Get-EXOMailbox · Get-InboxRule -Mailbox (per mailbox)
The scan runs one Get-InboxRule per mailbox in the single PowerShell runspace - on large tenants it takes a long time and other PowerShell reports wait until it finishes. External forwarding rules also appear in the existing 'Outlook Clients With External Forwarders' report.
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Suspicious Inbox Rules
After taking over a mailbox, attackers add inbox rules that delete or bury replies about 'invoice', 'payment' or 'password' so the victim never sees the fraud unfolding - often moving them to RSS Feeds or Archive. This scan reads every user and shared mailbox's inbox rules and lists the ones matching those patterns.
Press Run scan to read the inbox rules of every user and shared mailbox.