01-05-2018 11:42 AM
01-06-2018 03:06 AM
There are 3 things I would consider:
1. Determining how users are accessing their mailboxes in Office 365: https://www.cogmotive.com/blog/office-365-tips/determining-how-users-are-accessing-their-mailboxes-i...
2. You could enable Outlook logging and collect the log files i.e. on a file share.
3. Enable mailbox audit logging for those mailboxes and check if the log contains some information about IMAP and POP access and maybe activities.
01-08-2018 08:38 AM
Thanks for outlining the options, @Dominik Hoefling! Other than enabling verbose logging in Outlook (which slows Outlook), I have done the other 2, but have not gotten the information on IMAP detailed events logging. I saw that the account connected via IMAP, but I did not see if the Inbox folder was downloaded, or emails were synced.