Forum Discussion
Audit a users method of using email
I would like to know where in gui or in ps I run a audit to find user 'Jeremy' has logged into his email from, whether it was from owa, a thick client outlook, mobile phone, etc. Hoping to see detail...
Check the mailbox audit logs, or the corresponding entries in the unified audit log: https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide
Been there done that, I am unable to find what app is used by the user. If you know what exactly what activity that is please do share. Id like a ps script.