Before
Security or IT teams would likely need to review existing mailbox subscriptions, remove outdated entries, identify eligible employees, and create or renew monitoring subscriptions one user at a time. Keeping coverage current would also depend on repeating those checks before subscriptions expired and coordinating the handoff to the email-analysis process.
How it works
- On a scheduled interval, retrieve current Exchange subscriptions and remove them when they exist.
- Retrieve users and retain those with the required Office subscription before iterating through the eligible employee list.
- Create a new inbox subscription for each qualifying user so received emails produce webhook notifications for the downstream analysis flow.
Workflow details
- Scheduled monitoring setup: The workflow runs at regular intervals to maintain continuous coverage of employee Exchange inboxes rather than relying on employees to identify suspicious or important messages themselves.
- Subscription cleanup: It retrieves existing mailbox subscriptions and deletes them when present, preventing outdated subscriptions from remaining active before the next monitoring cycle is configured.
- User qualification: It retrieves users and filters the results for accounts with the required Office subscription identifier, creating a monitored population from the organization’s current user data.
- Mailbox subscription creation: For each qualifying user, the workflow creates an inbox subscription for newly created messages and assigns a webhook notification URL. The subscription is configured with an expiration time approximately five days after the scheduled setup.
- Downstream handoff: When an employee receives an email, the resulting webhook notification is delivered to another flow dedicated to analyzing the message through a multi-layered approach.
What changed
Mailbox monitoring is rebuilt automatically on each scheduled run instead of being maintained through individual subscription checks and renewals. The workflow handles subscription cleanup and user qualification, while the downstream analysis flow receives a webhook notification whenever a monitored inbox receives a new email.
Work removed
Manually listing current mailbox subscriptions, deleting outdated subscriptions, identifying users with the required Office license, creating inbox subscriptions for each eligible user, and arranging the notification handoff for newly received emails.
Expected outcome
Coverage is established for each qualifying user on every scheduled cycle, with subscriptions configured for an approximately five-day expiration window and one downstream notification opportunity per newly received email.
