Forum Discussion
Who is reading other's emails without authorization?
An employee is complaining they suspect their emails are being read without consent. Their password may have been compromised. Does Office 365 Exchange store the IP address where an organization's internal email changed unread state to read state?
- 90% of these will be picked up one of two ways. Search for exchange mailbox rule changes in the compliance auditing. Or check in azure ad portal and suspicious sign ins for an impossible sign in. You’ll see users that might have people logging in from Africa and what not if compromised
- Make sure auditing is enabled on mailbox.
- Run audit log searches in security and compliance center.
- Mention Start date, End date & Users.
- Check for different IP from your location.As a best practise Enable MFA.Regards,AkshaySystem Admin - Apps4Rent - Hi joym8,
See following article
https://techcommunity.microsoft.com/t5/Office-365/Can-I-audit-where-the-mailbox-over-log-in/m-p/150914?advanced=false&collapse_discussion=true&q=mailbox%20audit%20log&search_type=thread
You can see sign in activity through Azure AD > Monitoring > Sign Ins. This will show you the IP address where the user is logging in from
You could also look to use the audit log. As stated in the article the IP address corresponding to an activity performed by any user is included in most audit records. Information about the client used is also included in the audit record.
https://docs.microsoft.com/en-us/office365/securitycompliance/auditing-troubleshooting-scenarios
I would also check the Exchange Admin Centre to see if any mailbox permissions have been added to the user.
Hope that answers your questions
Best, ChrisWell if the password has been compromised, you will not be able to get much information out of the Exchange audit logs, as Onwer actions are not being audited. So at best you can see when the user logged in from a different/unknown IP and try to correlate this with the date the messages in question were received.
