Home / server / Questions / 1027388
In Process
Jason
Asked: 2020-07-31 16:07:03 +0800 CST

How can I tell if a user has more than one computer logging with Outlook?

  • 772

I have reason to suspect that a user may be accessing their company email using a copy of Microsoft Outlook (or perhaps another email client) from a personal device for the purpose of data exfiltration. I've ruled out them accessing their account using ActiveSync (using Get-ActiveSyncDeviceStatistics -Mailbox [username] | ft DeviceType, DeviceUserAgent, LastSuccessSync in powershell) but I cannot seem to find a way to rule out the Outlook desktop app.

IMAP, POP3, and OWA are disabled for this user per corporate policy so I can rule those out as well.

Is there a way to tell which MAPI clients are or have authenticated with Exchange for a particular user? (This is hosted-exchange on an Office 365 tenant, and I have full admin permissions.)

exchange security powershell microsoft-office-365

2 Answers

  1. One way to do this would be to navigate to the Security and Compliance center in your Office 365 tenant, navigate to Search, then to Audit log search, then do a search for "User signed into mailbox" (under Activities>Exchange Mailbox activities) and focus the search on your user. Look for the ip address your user has signed in from. If you've disabled all but Outlook desktop (MAPI) then any logins you see can only be from the Outlook client. If you see ip addresses other than your company ip address than that's an indication that the user is using Outlook to access their mailbox from locations other than the company network.

    Another way to do it would be to navigate to the Azure AD admin center, navigate to Users, then to Sign-ins, and filter the sign-ins log for your user and for the client app. You can filter on several modern auth and legacy auth clients to narrow it down to what you're looking for. Once you find the activity, again look at the ip addresses associated with the activity and deduce from there.

    • 11

  2. Agree with joeqwerty, you could use the Audit Log search feature in office 365 to search the entries about the login records.

    Besides, maybe the Mailbox Audit Log could help you trace the client access too, and you could run the following command to enable it, then run a non-owner mailbox access report to view the mailbox actions(Here is a guide about Mailbox Audit Logging for your reference, it should be suitable for Exchange Online too: Mailbox audit logging in Exchange 2016):

    Set-Mailbox -Identity "<Mailbox Name>" -AuditEnabled $true

    Hope the above information is helpful to you.

    • 2