Auditing Microsoft 365 mailbox delegates

The users who are assigned mailbox permissions to access and use mailboxes of other users in the organization are called delegates. The three most generic permissions that can be assigned to users are: Send on Behalf, Send As, and Full Access. The delegates with these permissions can send emails on behalf of a user, as a user, and can even access the designated mailbox directly. Keeping an eye on the activities of the delegates is therefore vital to ensure internal security and proper use of the assigned permissions. This can be done by auditing every change and every action of the delegates.

Using the admin portal in the native tools offered by Microsoft, you might have to use complex PowerShell codes for detailed auditing. M365 Security Plus, a Microsoft 365 auditing, alerting, and monitoring tool, helps you save time by tracking and retrieving the activity logs of delegates as and when required. M365 Security Plus provides a default audit profile called Activities by Mailbox Delegates, which provides one-click access to the required audit data.

Note: Auditing must be enabled first for all the mailboxes to view these audit log. This can be done by clicking on the Enable Now option that appears under the Audit tab.

Steps to view the default audit profile

1. Under Auditing & Monitoring section, click the Audit tab.
2. Navigate to Exchange Online > Exchange Activity > Activities by Mailbox Delegates.
3. Select the Domains and Period for report generation.

And that's it. The report gets generated instantly. You can filter the columns required and create a new view if needed.

Steps to create an audit profile

With the steps given below, you can create and use new audit profiles in M365 Security Plus to get instant updates about various user actions or to track other activities in your Exchange environment.

1. Go to Settings.
2. Navigate to Configuration > Audit Configuration > Audit Profiles.
3. Click Add Profile.
4. In the window that appears, enter a suitable Name for the audit profile and Description.
5. Choose a Microsoft 365 Service and Category from the drop-downs.
6. Select the Actions you would like to audit.
7. Under Advanced Configuration, you can choose to filter based on business hours or report columns.
8. Click Add.

Learn more about how M365 Security Plus helps simplify complex Microsoft 365 tasks.