I have reason to suspect that a user may be accessing their company email using a copy of Microsoft Outlook (or perhaps another email client) from a personal device for the purpose of data exfiltration. I've ruled out them accessing their account using ActiveSync (using
Get-ActiveSyncDeviceStatistics -Mailbox [username] | ft DeviceType, DeviceUserAgent, LastSuccessSync in powershell) but I cannot seem to find a way to rule out the Outlook desktop app.
IMAP, POP3, and OWA are disabled for this user per corporate policy so I can rule those out as well.
Is there a way to tell which MAPI clients are or have authenticated with Exchange for a particular user? (This is hosted-exchange on an Office 365 tenant, and I have full admin permissions.)