Audit of delegates??

Copper Contributor

I need to start auditing when a delegate assignment or removal happens.  I am a global admin for M365.  How can I be notified when someone (probably an Admin) adds themselves to be a delegate for someone’s mailbox?


this is needed as i believe an employee may be doing this for C level email accounts.


please help.




1 Reply
It's all audited as part of the Unified audit log:
Alerting is trickier, as there is no good solution for this within M365. Activity alerts/Alert policies can cover some scenarios, but more robust alerting will require Defender for Cloud App or SIEM solution such as Sentinel.