Do you monitor for mailbox forwarding rules, impossible travel, and multi-factor changes?

We run our own security monitoring platform and feed Microsoft 365 audit activity into it. The detections that matter for your business are the quiet ones that indicate someone else is in a mailbox:

• Inbox rules created that forward, delete, or move messages, especially rules that hide replies containing words like wire, invoice, or payoff
• Mailbox forwarding configured to an external address
• Multi factor authentication methods added or changed on an account
• Sign-ins from locations you do not operate in, and sign-in pairs too far apart in time to be physically possible
• Mailbox access by an account other than the owner
• Searches run across mailboxes using administrative discovery tools
• New administrative privilege granted to an account

Most attackers create a rule within minutes of getting in. That rule is often the earliest reliable evidence you have, and it is invisible to the person whose mailbox it is.

Worth asking any provider whether they are monitoring Microsoft 365 audit logs at all. Many are watching servers and workstations only, which means the attack surface that actually matters to a title agency is unwatched.