Must find time to dig into this. Maybe I'll set an OOO. That'll surely prevent new work from coming in.

https://twitter.com/Viss/status/1016445316772462593?s=19

https://lmgsecurity.com/exposing-the-secret-office-365-forensics-tool/

https://www.crowdstrike.com/blog/hiding-in-plain-sight-using-the-office-365-activities-api-to-investigate-business-email-compromises/