TP: If you're able to confirm that inbox rule was created by an OAuth 3rd-occasion application with suspicious scopes sent from an unfamiliar source, then a real positive is indicated.Encouraged steps: Classify the alert to be a TP. Determined by the investigation, Should the application is malicious, you'll be able to revoke consents and disable t