3

An email was sent on behalf of another user that should not have been sent. Multiple people have this permission. How do I find out who sent the email? Assume it's been deleted from sent items. Using Office365 hosted exchange.

2 Answers 2

1

If you have audit log enabled (it isn't by default) in the security and compliance centre it tells you this information.

https://support.office.com/en-us/article/Search-the-audit-log-in-the-Office-365-Security-Compliance-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c

1
  • You must also enable mailbox auditing, and set the actions to be audited. SendAs and SendonBehalf are auditabled actions. This is set on a per mailbox basis, and must explicitly be enabled, and it is not retroactive. You shoudl be able to get the support article by searching for exchange online mailbox auditing ( bing.com/… ) Aug 5, 2018 at 22:38
0

You will want to run a message trace from the Office 365 administration center. Note that there are different instructions for emails that are either under or over 7 days old.

1
  • Message trace doesn't give me the required information. Message trace tells me the mailbox that was used 'on behalf of', not the person who sent the message. E.g. User A sends a message on behalf of User B. Message trace shows email went out from User B and nothing about User A.
    – Simkill
    Aug 2, 2018 at 15:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .