overwrites-custom-o365.xml

<!-- Modify it at your will. -->
<group name="overwrites-custom-o365,">
   <rule id="118001" level="4">
    <if_sid>91725</if_sid>
    <field name="office365.objectid" type="pcre2">(?i).+\.prod\.outlook\.com\/Microsoft Exchange Hosted Organizations\/.+\.onmicrosoft\.com\/DiscoverySearchMailbox{.+-.+-.+-.+-.+}</field>
    <description>Office 365: User got FullAccess permissions in Exchange (Downlevel DiscoverySearchMailbox)</description>
  </rule>
  <!-- Funktioniert noch nicht -->
<rule id="118002" level="12">
    <if_group>office365</if_group>
    <field name="GeoLocation.country_name">!Germany</field>
    <description>Office 365 used in: $(GeoLocation.country_name).</description>
  </rule>
</group>