Forum Discussion
MCAS: Create Item Impersonated activity
Hi Community!
Found this activity on one of our users "Create Item (Impersonated)" in Exchange Online. Been looking for a description for this but this is what I found:
https://docs.microsoft.com/en-us/cloud-app-security/activity-filters-queries
Is this caused by Mailbox Delegation in Exchange Online? If yes what activity triggered this?
Would like to know a much detailed description for this activity.
Thank you!
1 Reply
- Caroline_Lee
Microsoft
Mary_Yvette Thanks for the question! Check out the impersonated activity in the investigation alerts guide:
