TP: If you can confirm that inbox rule was designed by an OAuth 3rd-get together app with suspicious scopes sent from an mysterious source, then a real positive is detected.Review consent grants to the applying created by users and admins. Investigate all things to do performed through the application, In particular entry to mailbox of associated p