Alert on disabled user

%3CLINGO-SUB%20id%3D%22lingo-sub-1737638%22%20slang%3D%22en-US%22%3EAlert%20on%20disabled%20user%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1737638%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3EWe%20received%20a%20%22Suspicious%20email%20deletion%20activity%22%20alert%20today%20for%20activity%20%22Purge%20messages%20from%20the%20mailbox%3A%20...%22.%20The%20user%20account%20is%20not%20allowed%20to%20sign-in%20and%20has%20no%20licenses%20assigned.%20His%20MFA%20is%20enforced.%20How%20could%20that%20be%3F%20Is%20it%20possible%20that%20an%20internal%20purging%20process%20triggered%20this%20alert%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1737638%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECloud%20App%20Security%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1745893%22%20slang%3D%22en-US%22%3ERe%3A%20Alert%20on%20disabled%20user%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1745893%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F52093%22%20target%3D%22_blank%22%3E%40Sagy%20Langer%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20are%20seeing%20these%20alerts%20lately%20too%20on%20many%20users.%20And%20some%20indeed%20are%20disabled%20users.%26nbsp%3B%20Any%20idea%20what's%20going%20on%20MS%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
Senior Member

Hi,

We received a "Suspicious email deletion activity" alert today for activity "Purge messages from the mailbox: ...". The user account is not allowed to sign-in and has no licenses assigned. His MFA is enforced. How could that be? Is it possible that an internal purging process triggered this alert?

 

Thanks.

1 Reply

@Sagy Langer 

 

We are seeing these alerts lately too on many users. And some indeed are disabled users.  Any idea what's going on MS?