What does Activity "SupervisoryReviewOLAudit" in Exchange mean - especially regarding EXTERNAL users

%3CLINGO-SUB%20id%3D%22lingo-sub-1201279%22%20slang%3D%22en-US%22%3EWhat%20does%20Activity%20%22SupervisoryReviewOLAudit%22%20in%20Exchange%20mean%20-%20especially%20regarding%20EXTERNAL%20users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1201279%22%20slang%3D%22en-US%22%3E%3CP%3Ehi%20all%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20recently%20noticed%20that%20I%20have%20a%20number%20of%20activity%20logs%20with%20%22SupervisoryReviewOLAudit%22%20in%20Exchange%20and%20the%20User%20is%20EXTERNAL.%20The%20external%20user%20also%20confuses%20it%20for%20me%2C%20for%20example%2C%20%3CA%20href%3D%22mailto%3Ainfo%40twitter.com%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Einfo%40twitter.com%3C%2FA%3E%26nbsp%3Band%20%3CA%20href%3D%22mailto%3Amonitoring%40bbc.co.uk%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Emonitoring%40bbc.co.uk%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECan%20anyone%20explain%20a%20few%20things%3C%2FP%3E%3CP%3E1%2F%20what%20is%20the%20activity%20type%20-%26nbsp%3B%3CSPAN%3ERun%20command%3C%2FSPAN%3E%3CSPAN%3E%3A%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Etask%26nbsp%3B%3CSTRONG%3ESupervisoryReviewOLAudit%3C%2FSTRONG%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E2%2F%20and%20what%20do%20the%20external%20users%20mean%20in%20this%20case%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ELet%20me%20know%20if%20I%20need%20to%20clarify%20any%20points%20or%20provide%20more%20detail.%20Thanks%20for%20reading%2C%20regards%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EJag%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1201279%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECloud%20App%20Security%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1204468%22%20slang%3D%22en-US%22%3ERe%3A%20What%20does%20Activity%20%22SupervisoryReviewOLAudit%22%20in%20Exchange%20mean%20-%20especially%20regarding%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1204468%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F141477%22%20target%3D%22_blank%22%3E%40Jagdip%20Mander%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESupervisory%20Review%20is%20likely%20referring%20to%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fcompliance%2Fsupervision-policies%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fcompliance%2Fsupervision-policies%3Fview%3Do365-worldwide%3C%2FA%3E%26nbsp%3BCheck%20your%20policies%20in%20the%20Microsoft%20Security%20Center%20and%20Exchange%20Online.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EInternal%20and%20External%20users%20in%20MCAS%20are%20defined%20via%20the%20managed%20domain%20configuration%20located%20in%20MCAS%20Settings%20%26gt%3B%20Organization%20details%20%26gt%3B%20Managed%20domains%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Fgeneral-setup%23set-up-the-portal%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fcloud-app-security%2Fgeneral-setup%23set-up-the-portal%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1399969%22%20slang%3D%22en-US%22%3ERe%3A%20What%20does%20Activity%20%22SupervisoryReviewOLAudit%22%20in%20Exchange%20mean%20-%20especially%20regarding%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1399969%22%20slang%3D%22en-US%22%3Ehere%20is%20the%20documentation%20for%20this%20event%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice%2Foffice-365-management-api%2Foffice-365-management-activity-api-schema%23communication-compliance-exchange-schema%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Foffice%2Foffice-365-management-api%2Foffice-365-management-activity-api-schema%23communication-compliance-exchange-schema%3C%2FA%3E%3C%2FLINGO-BODY%3E
New Contributor

hi all

 

I have recently noticed that I have a number of activity logs with "SupervisoryReviewOLAudit" in Exchange and the User is EXTERNAL. The external user also confuses it for me, for example, info@twitter.com and monitoring@bbc.co.uk

 

Can anyone explain a few things

1/ what is the activity type - Run commandtask SupervisoryReviewOLAudit

2/ and what do the external users mean in this case

 

Let me know if I need to clarify any points or provide more detail. Thanks for reading, regards

 

Jag

2 Replies

@Jagdip Mander 

 

Supervisory Review is likely referring to https://docs.microsoft.com/en-us/microsoft-365/compliance/supervision-policies?view=o365-worldwide Check your policies in the Microsoft Security Center and Exchange Online.

 

Internal and External users in MCAS are defined via the managed domain configuration located in MCAS Settings > Organization details > Managed domains

https://docs.microsoft.com/en-us/cloud-app-security/general-setup#set-up-the-portal