Microsoft Secure Tech Accelerator
Apr 13 2023, 07:00 AM - 12:00 PM (PDT)
Microsoft Tech Community

MCAS: Create Item Impersonated activity


Hi Community!


Found this activity on one of our users "Create Item (Impersonated)" in Exchange Online. Been looking for a description for this but this is what I found:



Is this caused by Mailbox Delegation in Exchange Online? If yes what activity triggered this?

Would like to know a much detailed description for this activity.


Thank you!

1 Reply

@Mary_Yvette Thanks for the question! Check out the impersonated activity in the investigation alerts guide: