> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Mailbox Rule Remediation

> Delete malicious Microsoft inbox rules

Attackers who take over a mailbox often add an inbox rule that forwards, hides, or deletes mail so they can keep watching it unnoticed. Mailbox rule remediation deletes the exact inbox rule a malicious detection reports, using the [Microsoft](/integrations/microsoft) integration that reported it.

Mailbox rule deletion runs automatically from verdict rules. It is not offered in the case **Actions > Remediate** dialog.

## Remediation Actions

* **Delete Mailbox Rule** — permanently delete the inbox rule from the user's Microsoft mailbox (irreversible)

<Warning>
  Delete Mailbox Rule is irreversible, and there is no release action. If a rule is deleted by mistake, the mailbox owner must recreate it.
</Warning>

## Turning it on

Automatic deletion needs all of the following:

1. **Enable Automated Remediations** is on under **Settings > Remediation** (see [Introduction to Remediation](/remediation/introduction)).
2. **Mailbox Rule Auto Remediation** is on under **Settings > Remediation > Configuration**. It is on by default.
3. The matching [verdict rule](/verdicts/introduction#delete-mailbox-rule) has **Delete Mailbox Rule** selected. The option is only available on **Malicious** verdict rules in the **Mailbox Rule** category, and it is off on every rule Wirespeed ships.
4. The Microsoft integration that reported the detection is not read-only and has been granted the `MailboxSettings.ReadWrite` permission. See [Microsoft remediation access](/integrations/microsoft#remediation-access).

Just before deleting, Wirespeed checks again that the detection is still malicious, that its verdict rule still asks for deletion, and that both settings above are still on. If anything changed, the deletion does not run.

## Which rules can be deleted

Wirespeed deletes a rule only when it can identify it exactly:

* The detection reports a single mailbox rule, with the mailbox that owns it.
* The rule was created or changed in Outlook or Outlook on the web. Microsoft records these changes with the rule's identifier. Rules created or changed with PowerShell (`New-InboxRule`, `Set-InboxRule`) are recorded without it, so they cannot be deleted automatically.
* The rule belongs to the same Microsoft tenant as the connected integration.

Wirespeed never searches the mailbox for similar rules; it deletes only the rule the detection names.

## Where results appear

* **Case timeline** — the deletion and its outcome.
* **Detection next steps** — a **Delete mailbox rule** step under Remediate. It is marked done when the rule is deleted, failed when Microsoft refused the deletion, or skipped with a reason when Mailbox Rule Auto Remediation is off or no rule on the detection could be deleted.
* **Settings > Remediation** — **Actions Taken** lists each deleted rule by name and mailbox; **Actions Blocked** lists deletions stopped by a setting.
* The [Activity Summary](/settings/notifications#activity-summary) email and the Security Overview report count deleted mailbox rules.

## Supported integrations

* [Microsoft](/integrations/microsoft)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.