MCAS: Create Item Impersonated activity

%3CLINGO-SUB%20id%3D%22lingo-sub-1462503%22%20slang%3D%22en-US%22%3EMCAS%3A%20Create%20Item%20Impersonated%20activity%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1462503%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Community!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFound%20this%20activity%20on%20one%20of%20our%20users%20%22Create%20Item%20(Impersonated)%22%20in%20Exchange%20Online.%20Been%20looking%20for%20a%20description%20for%20this%20but%20this%20is%20what%20I%20found%3A%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Mary_Yvette_0-1592195089246.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F198769i97E87B5B2D6B3F17%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20title%3D%22Mary_Yvette_0-1592195089246.png%22%20alt%3D%22Mary_Yvette_0-1592195089246.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Factivity-filters-queries%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Factivity-filters-queries%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20this%20caused%20by%20Mailbox%20Delegation%20in%20Exchange%20Online%3F%20If%20yes%20what%20activity%20triggered%20this%3F%3C%2FP%3E%3CP%3EWould%20like%20to%20know%20a%20much%20detailed%20description%20for%20this%20activity.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1462503%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECloud%20App%20Security%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1474316%22%20slang%3D%22en-US%22%3ERe%3A%20MCAS%3A%20Create%20Item%20Impersonated%20activity%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1474316%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F342175%22%20target%3D%22_blank%22%3E%40Mary_Yvette%3C%2FA%3E%26nbsp%3BThanks%20for%20the%20question!%20Check%20out%20the%20impersonated%20activity%20in%20the%20investigation%20alerts%20guide%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Finvestigate-anomaly-alerts%23unusual-impersonated-activity-by-user%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Finvestigate-anomaly-alerts%23unusual-impersonated-activity-by-user%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

Hi Community!

 

Found this activity on one of our users "Create Item (Impersonated)" in Exchange Online. Been looking for a description for this but this is what I found:

Mary_Yvette_0-1592195089246.png

https://docs.microsoft.com/en-us/cloud-app-security/activity-filters-queries

 

Is this caused by Mailbox Delegation in Exchange Online? If yes what activity triggered this?

Would like to know a much detailed description for this activity.

 

Thank you!

1 Reply

@Mary_Yvette Thanks for the question! Check out the impersonated activity in the investigation alerts guide:

 

https://docs.microsoft.com/en-us/cloud-app-security/investigate-anomaly-alerts#unusual-impersonated-...