Microsoft 365
Entra ID sign-ins, mailbox audit and OAuth consent events.
Category
Identity
Setup
About 15 minutes
Events Wardell reads
Entra sign-ins, mailbox rules, OAuth consents, SharePoint access
Wardell uses an app registration with read-only audit permissions. Entra ID sign-ins, the unified audit log and mailbox audit events arrive within two minutes.
Most business email compromise starts here: a consent to a look-alike app, then inbox rules that hide replies. Wardell groups those steps into one case and suggests the revoke.
What Wardell watches
OAuth consent phishing detections
Inbox rule and forwarding changes
Conditional access bypass alerts
Revoke app consent from the case view
Try it on your own logs
Connect this source with a read-only key. Within 48 hours a Wardell analyst sends a written report of what it would have caught.
