Audit a users method of using email

%3CLINGO-SUB%20id%3D%22lingo-sub-2435054%22%20slang%3D%22en-US%22%3EAudit%20a%20users%20method%20of%20using%20email%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2435054%22%20slang%3D%22en-US%22%3E%3CP%3EI%20would%20like%20to%20know%20where%20in%20gui%20or%20in%20ps%20I%20run%20a%20audit%20to%20find%20user%20'Jeremy'%20has%20logged%20into%20his%20email%20from%2C%20whether%20it%20was%20from%20owa%2C%20a%20thick%20client%20outlook%2C%20mobile%20phone%2C%20etc.%20Hoping%20to%20see%20details%20on%20the%20client%20side%20like%20ip%20address%20of%20the%20users%20session%2C%20possibly%20computer%20host%20name%2C%20etc%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2435054%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%20Administration%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2438018%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20a%20users%20method%20of%20using%20email%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2438018%22%20slang%3D%22en-US%22%3ECheck%20the%20mailbox%20audit%20logs%2C%20or%20the%20corresponding%20entries%20in%20the%20unified%20audit%20log%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fcompliance%2Fsearch-the-audit-log-in-security-and-compliance%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fcompliance%2Fsearch-the-audit-log-in-security-and-compliance%3Fview%3Do365-worldwide%3C%2FA%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2440283%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20a%20users%20method%20of%20using%20email%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2440283%22%20slang%3D%22en-US%22%3EBeen%20there%20done%20that%2C%20I%20am%20unable%20to%20find%20what%20app%20is%20used%20by%20the%20user.%20If%20you%20know%20what%20exactly%20what%20activity%20that%20is%20please%20do%20share.%20Id%20like%20a%20ps%20script.%3C%2FLINGO-BODY%3E
Occasional Visitor

I would like to know where in gui or in ps I run a audit to find user 'Jeremy' has logged into his email from, whether it was from owa, a thick client outlook, mobile phone, etc. Hoping to see details on the client side like ip address of the users session, possibly computer host name, etc

2 Replies
Check the mailbox audit logs, or the corresponding entries in the unified audit log: https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compl...
Been there done that, I am unable to find what app is used by the user. If you know what exactly what activity that is please do share. Id like a ps script.