TP: If you're able to verify that inbox rule was created by an OAuth 3rd-get together application with suspicious scopes sent from an not known resource, then a true positive is indicated.FP: If after investigation, you could affirm which the application provides a legitimate business use during the Firm.When you have a keen eye and so are bothered