Security Policy Errors

How to Investigate Microsoft Defender Alerts for a Missing Mailbox

Muhammad Talha Oct 12, 2026 870 views

Question details

Users receive Microsoft Defender alerts for auto-forwarding activity related to an unrecognized mailbox named SecurityComplianceInsights.

How to Investigate Microsoft Defender Alerts for a Missing Mailbox

Product: Microsoft Defender / Exchange Online
Device & OS: not provided
Scenario: Investigating suspicious auto-forwarded message alerts triggered in Microsoft Defender for an unknown entity.
Observed behavior: Defender triggers a forwarding alert referencing a nonexistent SecurityComplianceInsights mailbox, an undefined IP address, and a Mailbox:null entity.

Before you start

Ensure you have global admin or security admin privileges in your Microsoft 365 tenant to access the Exchange Admin Center and run message traces.

Solution 1Recommended

Verify Mailbox and Transport Rules in Exchange Admin Center

Check for any hidden forwarding rules or trace messages to confirm if the reported mailbox actually exists in your tenant.

Before concluding that the alert is a false positive, you must definitively rule out the existence of the mailbox and any associated transport rules.

Check Auto-forwarded Messages

Log in to the Exchange Admin Center and navigate to Reports > Mail flow > Auto forwarded message report to check for unauthorized forwarding.

Run a Message Trace

Perform a message trace to see if 'SecurityComplianceInsights' can be selected as a sender or recipient. If it cannot be selected, the mailbox does not exist.

Review Transport Rules

Check your Exchange Transport Rules under the Mail flow section to ensure no active rules are referencing this unknown mailbox name.

Verify Mailbox and Transport Rules in Exchange Admin Center

False Positives: If the message trace cannot find the mailbox, the IP address is undefined, and no rules reference it, this is likely a false positive caused by stale internal data.

Solution 2

Report Stale Alert Data to Microsoft Support

If no matching object exists in your tenant, the alert is likely caused by an internal Microsoft sync issue or stale pointer that requires support intervention.

Free Microsoft Office alternative

Manage Your Security Reports and Documentation with WPS Office

While investigating Microsoft 365 tenant security alerts, use WPS Office as a free, lightweight, and highly compatible alternative to Microsoft Office to document findings, draft support tickets, and analyze exported report data.

1. Download and Install: Get the free WPS Office suite from the official website and install it on your computer.
2. Analyze Exported Data: Open your exported CSV or Excel message trace reports using WPS Spreadsheet to filter and analyze the data.
3. Document Findings: Use WPS Writer to compile your investigation notes and prepare your support request details.

Fully compatible with Microsoft Excel (.xlsx) formats for analyzing exported Exchange message traces and CSV logs.Lightweight installation with a familiar, easy-to-use tabbed interface.Free alternative to Microsoft Word for drafting incident reports and support documentation.Seamless document migration with built-in PDF conversion tools.

microsoft office alternative - wps office

Frequently Asked Questions

Why is Microsoft Defender reporting a mailbox named SecurityComplianceInsights?

This typically occurs due to an internal sync issue or stale alert data within Exchange Online, generating false alerts for a nonexistent mailbox or an undefined IP address.

How can I check if auto-forwarding is actually happening in my tenant?

You can verify real auto-forwarding activity by visiting the Exchange Admin Center, navigating to Reports, selecting Mail flow, and viewing the Auto forwarded message report.

What does 'Mailbox:null' mean in a Defender security alert?

A 'Mailbox:null' entity indicates that the alert is referencing a mailbox pointer that does not actually exist in your tenant directory, confirming that the alert is likely a false positive.

Microsoft Office Security Issues