TP: If you can validate that inbox rule was designed by an OAuth 3rd-occasion application with suspicious scopes delivered from an unknown source, then a true constructive is indicated. Verify whether the app is essential in your Firm in advance of taking into consideration any containmen