In Microsoft's infinite wisdom, they took away admins' ability to access users' mailbox rules from within Exchange Admin Center because they want us to use PowerShell instead. This would be fine except it seems that, according to others who experienced the same issue, running Get-InboxRule -Mailbox fullemailaddresshere -IncludeHidden doesn't show hidden rules with the following characters in the name, specifically / (forward slash), ; (semicolon), ' (apostrophe), [ (open bracket), ] (close bracket), or . (period).
Other previous options used to be to go to https://outlook.office.com/ecp/fullemailaddresshere to change them there but that no longer works either. It now returns "400, bad request".
Another one they used to suggest was https://outlook.office.com/mail/fullemailaddresshere/options/mail/rules but that now just returns an "access denied" error.
From what I'm finding, it seems the only way to remove the rule would be to change the password and re-enable the compromised account, revoke and reset MFA, set up MFA with a temporary device, sign in, go to Rules, and delete it from there. Keep in mind, we'd have to remember to remove the temporary MFA device when we're done.
Am I missing something?