TP: If you're able to validate that inbox rule was produced by an OAuth 3rd-occasion app with suspicious scopes shipped from an mysterious source, then a real constructive is detected.TP: If you’re in a position to ensure that prime quantity of crucial email read through by means of Graph API by an OAuth application with large privilege scope