2

An email was sent on behalf of another user that should not have been sent. Multiple people have this permission. How do I find out who sent the email? Assume it's been deleted from sent items. Using Office365 hosted exchange.

1

If you have audit log enabled (it isn't by default) in the security and compliance centre it tells you this information.

https://support.office.com/en-us/article/Search-the-audit-log-in-the-Office-365-Security-Compliance-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c

1
  • You must also enable mailbox auditing, and set the actions to be audited. SendAs and SendonBehalf are auditabled actions. This is set on a per mailbox basis, and must explicitly be enabled, and it is not retroactive. You shoudl be able to get the support article by searching for exchange online mailbox auditing ( bing.com/… ) – Jesus Shelby Aug 5 '18 at 22:38
0

You will want to run a message trace from the Office 365 administration center. Note that there are different instructions for emails that are either under or over 7 days old.

1
  • Message trace doesn't give me the required information. Message trace tells me the mailbox that was used 'on behalf of', not the person who sent the message. E.g. User A sends a message on behalf of User B. Message trace shows email went out from User B and nothing about User A. – Simkill Aug 2 '18 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.