I am following up an interesting occurrence in which the 'Office 365 Message Encryption Portal' was integrated into our Azure subscription without any admin doing so. It turns out a standard user's account is associated with this integration however, this was not planned or expected in any way.
Is there a way I can determine how this took place? The owner of the non-admin user account was in a meeting while this integration took place and has no knowledge about their account being used for this purpose.
Does anyone have any idea what could have caused this integration to happen?
This is concerning on several levels. Here are some details, please let me know if there are another other logs or info I could use to determine what happened.
Properties:
'Homepage URL': https://products.office.com/en-us/exchange/office-365-message-encryption
'User Assignment Required': 'No'
Owners: None assigned
Roles and Admins: No accounts assigned to 'App admin', 'Cloud application admin' or 'Reports reader' roles.
Users and groups: User associated with integration with 'Default Access' Role assigned
Self Service Portal is not configured (and 'Allow users to request access to this application?' is toggled off)
SSO, Provisioning and Self-Service are all not enabled nor configured
'Permissions' are not set or configured in any way
Activity > Audit Logs (chronological order):
account initiated and successfully implemented 'Add service principal' for Office 365 Message Encryption Portal
account initiated and successfully implemented 'Add delegated permission grant' for Microsoft Graph, 3ada7267-11d0-4113-99fe-538c9edaeff6
account initiated and successfully implemented 'Add app role assignment granted' for Office 365 Message Encryption Portal
account initiated and successfully implemented 'Consent to Application' for Office 365 Message Encryption Portal
