[Email Security] Retro scan

src/content/docs/cloudflare-one/email-security/auto-moves.mdx

@@ -2,7 +2,7 @@
 title: Auto-move events
 pcx_content_type: how-to
 sidebar:
-  order: 5
+  order: 15
 ---
 
 Auto-move events are events where emails are automatically moved to different inboxes based on the disposition Email Security assigned to them.

src/content/docs/cloudflare-one/email-security/detection-settings/index.mdx

@@ -2,7 +2,7 @@
 pcx_content_type: navigation
 title: Detection settings
 sidebar:
-  order: 4
+  order: 14
   group:
     hideIndex: true
 ---

src/content/docs/cloudflare-one/email-security/directories/index.mdx

@@ -2,7 +2,7 @@
 title: Directories
 pcx_content_type: how-to
 sidebar:
-  order: 3
+  order: 13
 ---
 
 Directories are folders to store user data. Email Security allows you to manage directories from the Cloudflare dashboard.

src/content/docs/cloudflare-one/email-security/email-monitoring/index.mdx

@@ -2,7 +2,7 @@
 title: Email monitoring
 pcx_content_type: how-to
 sidebar:
-  order: 2
+  order: 12
 ---
 
 import { GlossaryTooltip, Render } from "~/components"

src/content/docs/cloudflare-one/email-security/outbound-dlp.mdx

@@ -2,7 +2,7 @@
 title: Outbound Data Loss Prevention (DLP)
 pcx_content_type: how-to
 sidebar:
-  order: 7
+  order: 17
 ---
 
 :::note[Compatibility]

src/content/docs/cloudflare-one/email-security/phish-guard.mdx

@@ -2,7 +2,7 @@
 title: PhishGuard
 pcx_content_type: how-to
 sidebar:
-  order: 8
+  order: 18
 ---
 
 PhishGuard is a managed email security service that provides resources for end-to-end phish and targeted attack management and response. With PhishGuard, you can preemptively block [phishing attacks](https://www.cloudflare.com/en-gb/learning/access-management/phishing-attack/), [malware](https://www.cloudflare.com/en-gb/learning/ddos/glossary/malware/), [Business Email Compromise (BEC)](https://www.cloudflare.com/en-gb/learning/email-security/business-email-compromise-bec/), and vendor email fraud.

src/content/docs/cloudflare-one/email-security/phish-submissions.mdx

@@ -2,7 +2,7 @@
 title: Phish submissions
 pcx_content_type: how-to
 sidebar:
-  order: 6
+  order: 16
 ---
 
 import { GlossaryTooltip, Render } from "~/components"

src/content/docs/cloudflare-one/email-security/reference/index.mdx

@@ -2,7 +2,7 @@
 title: Reference
 pcx_content_type: navigation
 sidebar:
-  order: 9
+  order: 19
   group:
     hideIndex: true
 ---

src/content/docs/cloudflare-one/email-security/retro-scan.mdx

@@ -0,0 +1,38 @@
+---
+title: Retro Scan
+pcx_content_type: how-to
+sidebar:
+  order: 10
+---
+
+Retro Scan allows you to scan up to 14 days of old messages in your Microsoft 365 inboxes and check if your current email security solution missed any threats. 
+
+To start a free scan:
+
+1. Log in to [Zero Trust](https://one.dash.cloudflare.com/).
+2. Select **Email Security** > **Overview**.
+3. Select **Start a free scan** > **Generate report**.
+4. Enable your [Microsoft integration](/cloudflare-one/email-security/setup/post-delivery-deployment/api/office365-api/#enable-microsoft-integration).
+5. Generate Retro Scan report:
+   - **Connect domains**: Select at least one domain from your integration.
+   - **Select current solution**: Select the email security tool you are currently using.
+   - **Review details**: Review the details you previously selected. Then, select **Continue**. You will be notified by email once the report is available.
+6. Go to your email inbox and select the link to view the full report.
+7. On the dashboard, select **View report**.
+
+The dashboard will display **Overview** and **Details** pages. 
+
+### Overview
+
+Overview displays the total scanned domains. The overview shows you:
+
+- [Disposition evaluation](/cloudflare-one/email-security/email-monitoring/#disposition-evaluation)
+- Malicious threat types
+- Malicious targets
+- Malicious threat origins
+
+### Details
+
+Details allows you to review the first 1,000 emails assigned a disposition.
+
+Select an email to review [details](/cloudflare-one/email-security/email-monitoring/search-email/#details) about the message. 

src/content/docs/cloudflare-one/email-security/setup/index.mdx

@@ -2,7 +2,7 @@
 title: Setup
 pcx_content_type: navigation
 sidebar:
-  order: 1
+  order: 11
 ---
 
 import { DirectoryListing } from "~/components"