Auditing Exchange Connections

%3CLINGO-SUB%20id%3D%22lingo-sub-1377598%22%20slang%3D%22en-US%22%3EAuditing%20Exchange%20Connections%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1377598%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20am%20looking%20for%20a%20way%20to%20audit%20Mapi%20connections%20to%20an%20On-Prem%20Exchange%20server%20using%20ADFS%2FMFA.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20can%20find%20logs%20for%20OWA%20and%20ActiveSync%20connections.%26nbsp%3B%20I%20can%20find%20information%20on%20who%20is%20using%20%22delegated%20authority%22%20to%20connect%20to%20a%20mailbox%2C%20but%20I'm%20specifically%20looking%20for%20information%20on%20who%20is%20connecting%20to%20the%20Exchange%20Server%20via%20Outlook%20via%20Mapi%2FBearer%2C%20or%20even%20more%20specifically%20failures%20to%20connect%2C%20along%20with%20all%20relevant%20information.%26nbsp%3B%20i.e.%20IP%20address%2C%20Account%2C%20reason%20of%20failure%20etc.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECan%20anyone%20recommend%20anything%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1377598%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EHybrid%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOutlook%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Occasional Contributor

Hi, 

 

I am looking for a way to audit Mapi connections to an On-Prem Exchange server using ADFS/MFA.

 

I can find logs for OWA and ActiveSync connections.  I can find information on who is using "delegated authority" to connect to a mailbox, but I'm specifically looking for information on who is connecting to the Exchange Server via Outlook via Mapi/Bearer, or even more specifically failures to connect, along with all relevant information.  i.e. IP address, Account, reason of failure etc.

 

Can anyone recommend anything?

 

Thanks

 

 

0 Replies