An email was sent on behalf of another user that should not have been sent. Multiple people have this permission. How do I find out who sent the email? Assume it's been deleted from sent items. Using Office365 hosted exchange.
2 Answers
If you have audit log enabled (it isn't by default) in the security and compliance centre it tells you this information.
-
You must also enable mailbox auditing, and set the actions to be audited. SendAs and SendonBehalf are auditabled actions. This is set on a per mailbox basis, and must explicitly be enabled, and it is not retroactive. You shoudl be able to get the support article by searching for exchange online mailbox auditing ( bing.com/… ) Aug 5, 2018 at 22:38
You will want to run a message trace from the Office 365 administration center. Note that there are different instructions for emails that are either under or over 7 days old.
-
Message trace doesn't give me the required information. Message trace tells me the mailbox that was used 'on behalf of', not the person who sent the message. E.g. User A sends a message on behalf of User B. Message trace shows email went out from User B and nothing about User A.– SimkillAug 2, 2018 at 15:18