Forum Discussion

Adrian Hyde's avatar
Adrian Hyde
Steel Contributor
Apr 10, 2018

Elevation of Exchange admin privilege Alerts

Does anyone else get these alerts?  From what I have been able to gather thus far, this BOXServiceAccount is used by Microsoft for management of the mailboxes and exchange servers.  What I haven't figured out is whether I should be concerned about these or what it means for our security footprint.

 

A low-severity alert has been triggered

Elevation of Exchange admin privilege

Severity: — Low

Time: 4/10/2018 1:26:11 PM (UTC)

Activity: GrantAdminPermission

User: BOXServiceAccount@namprd05.prod.outlook.com

Details: GrantAdminPermission. This alert is triggered whenever someone in your organization becomes an admin or gets new admin permissions.

  • I opened a support case, and was basically told it was safe to ignore since it is a back-end process. Unfortunately no additional details.
  • Saurav_Jha's avatar
    Saurav_Jha
    Copper Contributor

    Adrian Hyde 

     

    Do you get any ideas about this at that time?

    I already configured this privilege?

     

     

    Severity  Low

    Time Nov 12, 2019 12:15:00 PM
    Activity Granted Exchange admin permission
    Activity count 1 
    Details
    This alert is triggered when someone in your organization becomes an Exchange admin or gets new Exchange admin permissions -V1.0.0.1
    By the time this alert was triggered,
    email is hidden performed Granted Exchange admin permission 1 time
  • It looks like some server workflow, I'm almost certain we should not be getting such events. Reports it on the UPP network?

    • Adrian Hyde's avatar
      Adrian Hyde
      Steel Contributor
      I opened a support case, and was basically told it was safe to ignore since it is a back-end process. Unfortunately no additional details.

Resources