Blog Post

Exchange Team Blog
6 MIN READ

Contextualizing Attacker Activity within Sessions in Exchange Online

The_Exchange_Team's avatar
The_Exchange_Team
Icon for Microsoft rankMicrosoft
Jan 04, 2019
Overview The Exchange audit log is an important tool in the defender toolbox to understand the activity of users (or attackers masquerading as users) in an organization. Defenders can manually bro...
Updated Jul 01, 2019
Version 2.0
office 365
security
Tips 'n Tricks
Deleted's avatar
Deleted
Right now MailboxLogins are not mostly audited for modern auth, which also happens to be required for session ID. This is a known issue that we are working on rectifying. All other mailbox audit actions are audited for both legacy and modern auth and you should use them to identify suspicious/malicious sessions.
Deleted's avatar
Deleted
Jan 05, 2019
Jeff, any update here? It seems really odd that Microsoft would go and enable auditing for all tenants (Jan 2019), but omit what is probably the most useful event AuditOwner:MailboxLogin.