10

I have reason to suspect that a user may be accessing their company email using a copy of Microsoft Outlook (or perhaps another email client) from a personal device for the purpose of data exfiltration. I've ruled out them accessing their account using ActiveSync (using Get-ActiveSyncDeviceStatistics -Mailbox [username] | ft DeviceType, DeviceUserAgent, LastSuccessSync in powershell) but I cannot seem to find a way to rule out the Outlook desktop app.

IMAP, POP3, and OWA are disabled for this user per corporate policy so I can rule those out as well.

Is there a way to tell which MAPI clients are or have authenticated with Exchange for a particular user? (This is hosted-exchange on an Office 365 tenant, and I have full admin permissions.)

10

One way to do this would be to navigate to the Security and Compliance center in your Office 365 tenant, navigate to Search, then to Audit log search, then do a search for "User signed into mailbox" (under Activities>Exchange Mailbox activities) and focus the search on your user. Look for the ip address your user has signed in from. If you've disabled all but Outlook desktop (MAPI) then any logins you see can only be from the Outlook client. If you see ip addresses other than your company ip address than that's an indication that the user is using Outlook to access their mailbox from locations other than the company network.

Another way to do it would be to navigate to the Azure AD admin center, navigate to Users, then to Sign-ins, and filter the sign-ins log for your user and for the client app. You can filter on several modern auth and legacy auth clients to narrow it down to what you're looking for. Once you find the activity, again look at the ip addresses associated with the activity and deduce from there.

| improve this answer | |
2

Agree with joeqwerty, you could use the Audit Log search feature in office 365 to search the entries about the login records.

Besides, maybe the Mailbox Audit Log could help you trace the client access too, and you could run the following command to enable it, then run a non-owner mailbox access report to view the mailbox actions(Here is a guide about Mailbox Audit Logging for your reference, it should be suitable for Exchange Online too: Mailbox audit logging in Exchange 2016):

Set-Mailbox -Identity "<Mailbox Name>" -AuditEnabled $true

Hope the above information is helpful to you.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.