I'm trying to see if there is a way to automate disabling a user based on an O365 Activity Alert email? The email will have the user. Our AD is on prem. I'm trying to think of a way where the email would be sent somewhere that can parse the user and then run a powershell script to disable the user and then immediately sync using our AD connect.