Forum Discussion
Audit of delegates??
I need to start auditing when a delegate assignment or removal happens. I am a global admin for M365. How can I be notified when someone (probably an Admin) adds themselves to be a delegate for someone’s mailbox?
this is needed as i believe an employee may be doing this for C level email accounts.
please help.
1 Reply
- It's all audited as part of the Unified audit log: https://learn.microsoft.com/en-us/purview/audit-new-search
Alerting is trickier, as there is no good solution for this within M365. Activity alerts/Alert policies can cover some scenarios, but more robust alerting will require Defender for Cloud App or SIEM solution such as Sentinel.
