MCAS: Create Item Impersonated activity

[Mary_Yvette]

Hi Community!

Found this activity on one of our users "Create Item (Impersonated)" in Exchange Online. Been looking for a description for this but this is what I found:

https://docs.microsoft.com/en-us/cloud-app-security/activity-filters-queries

Is this caused by Mailbox Delegation in Exchange Online? If yes what activity triggered this?

Would like to know a much detailed description for this activity.

Thank you!

[#2]

@Mary_Yvette Thanks for the question! Check out the impersonated activity in the investigation alerts guide:

https://docs.microsoft.com/en-us/cloud-app-security/investigate-anomaly-alerts#unusual-impersonated-...