Forum Discussion
Solved
A low severity alert has been triggered
A low-severity alert has been triggered ⚠ Mailbox permissions granted Severity: ● Low Time: 8/1/2022 7:45:00 AM (UTC) Activity: AddMailboxPermission User: NT AUTHORITY\SYSTEM (Microsoft.Exchange...
- A user value of "NT AUTHORITY\SYSTEM (Microsoft.Exchange.Servicehost)" indicates that this is some background task performed by the system, you can ignore it.
If you want to find all the details, hit the corresponding button at the bottom, or run a query against the audit log. Here's an example value:
[
{
"Name": "DomainController",
"Value": ""
},
{
"Name": "Identity",
"Value": "EURPR03A001.prod.outlook.com/Microsoft Exchange Hosted Organizations/michev.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}"
},
{
"Name": "User",
"Value": "EURPR03A001.prod.outlook.com/Microsoft Exchange Hosted Organizations/michev.onmicrosoft.com/Discovery Management"
},
{
"Name": "AccessRights",
"Value": "FullAccess"
}
]
A user value of "NT AUTHORITY\SYSTEM (Microsoft.Exchange.Servicehost)" indicates that this is some background task performed by the system, you can ignore it.
If you want to find all the details, hit the corresponding button at the bottom, or run a query against the audit log. Here's an example value:
[
{
"Name": "DomainController",
"Value": ""
},
{
"Name": "Identity",
"Value": "EURPR03A001.prod.outlook.com/Microsoft Exchange Hosted Organizations/michev.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}"
},
{
"Name": "User",
"Value": "EURPR03A001.prod.outlook.com/Microsoft Exchange Hosted Organizations/michev.onmicrosoft.com/Discovery Management"
},
{
"Name": "AccessRights",
"Value": "FullAccess"
}
]
If you want to find all the details, hit the corresponding button at the bottom, or run a query against the audit log. Here's an example value:
[
{
"Name": "DomainController",
"Value": ""
},
{
"Name": "Identity",
"Value": "EURPR03A001.prod.outlook.com/Microsoft Exchange Hosted Organizations/michev.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}"
},
{
"Name": "User",
"Value": "EURPR03A001.prod.outlook.com/Microsoft Exchange Hosted Organizations/michev.onmicrosoft.com/Discovery Management"
},
{
"Name": "AccessRights",
"Value": "FullAccess"
}
]
- Thank you Vasil!
