Audit of delegates??

[nieukie]

I need to start auditing when a delegate assignment or removal happens.  I am a global admin for M365.  How can I be notified when someone (probably an Admin) adds themselves to be a delegate for someone’s mailbox?

this is needed as i believe an employee may be doing this for C level email accounts.

please help.

[#2]

It's all audited as part of the Unified audit log: https://learn.microsoft.com/en-us/purview/audit-new-search
Alerting is trickier, as there is no good solution for this within M365. Activity alerts/Alert policies can cover some scenarios, but more robust alerting will require Defender for Cloud App or SIEM solution such as Sentinel.