Forum Discussion

Jarno86's avatar
Jarno86
Copper Contributor
Nov 23, 2021
Solved

High upload by user, user does not know why

Goodevening,

 

We started with CAS last week and I noticed that one user (our director) has a very high upload in the dashboard investigate users. When I click on it, the high volume comes from Exchange but our director is not emailing much in the last week (299 mails send). The second highest user has also a high upload ratio in comparison with other users. Does anybody know if this is a red flag? Could the account be comprimised? How can I investigate this?

 

Sorry for my English, I'm not a native speaker.

  • Jarno86's avatar
    Jarno86
    Nov 24, 2021
    We found the problem. The Outlook profile was not synchronising good anymore and causing the large amount of upload. We had to make a new Outlook profile and everything is working good now. I'm glad it had nothing to do with criminal activities.

3 Replies

  • Jarno86's avatar
    Jarno86
    Copper Contributor
    Nov 24, 2021
    We found the problem. The Outlook profile was not synchronising good anymore and causing the large amount of upload. We had to make a new Outlook profile and everything is working good now. I'm glad it had nothing to do with criminal activities.
    • moderncloud1's avatar
      moderncloud1
      Copper Contributor
      Jun 05, 2023

      Jarno86 Hello, just curious, how did you come to the conclusion this alert was triggered because of an Outlook Profile?

      • WimVClapdurp's avatar
        WimVClapdurp
        Copper Contributor
        Jun 23, 2023
        @modencloud1 This is probably the case that Jarno86 looked in the MCAS dashboard and there it is listed as a user with high upload. So you start to investigate why this user is uploading so much. Then when you dive deeper you see that it is e-mail related. Next steps is to ask the user (director) why this is. As the user did not have a valid reason why this is. You start digging deeper. So they found out the profile sync was out of sync. Why this is is to much to remediate -> so solution is to scratch the profile and rebuild it. Then you see in the MCAS the user is syncing regular and all is ok.
        The MCAS dashboard shows a lot of valuable information about users in you tenant. Be aware to respect privacy matters especially in Europe GDPR. If you have a DPO consult together from this portal as it might contain sensitive information's.

Resources