What does Activity "SupervisoryReviewOLAudit" in Exchange mean - especially regarding EXTERNAL users

[Deleted]

hi all

I have recently noticed that I have a number of activity logs with "SupervisoryReviewOLAudit" in Exchange and the User is EXTERNAL. The external user also confuses it for me, for example, info@twitter.com and monitoring@bbc.co.uk

Can anyone explain a few things

1/ what is the activity type - Run command: task SupervisoryReviewOLAudit

2/ and what do the external users mean in this case

Let me know if I need to clarify any points or provide more detail. Thanks for reading, regards

Jag

[#2]

@Deleted 

Supervisory Review is likely referring to https://docs.microsoft.com/en-us/microsoft-365/compliance/supervision-policies?view=o365-worldwide Check your policies in the Microsoft Security Center and Exchange Online.

Internal and External users in MCAS are defined via the managed domain configuration located in MCAS Settings > Organization details > Managed domains

https://docs.microsoft.com/en-us/cloud-app-security/general-setup#set-up-the-portal

[#3]

here is the documentation for this event: https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api...