Jason's questions

I want to set up a mail flow rule which detects any email from outside the organization where To: and CC: don't specify an internal recipient (this would include emails which are bcc'd to internal users where the non-bcc'd recipients are exclusively outside the organization). Am I missing something?

This is meant as a mechanism for spam control.

I'm not really seeing any way to specify this in the mail flow rules though it could be done pretty easily with normal mailbox rules. Is there a way to do this at the organization level?

This is on Exchange Server from Office 365.

I have reason to suspect that a user may be accessing their company email using a copy of Microsoft Outlook (or perhaps another email client) from a personal device for the purpose of data exfiltration. I've ruled out them accessing their account using ActiveSync (using Get-ActiveSyncDeviceStatistics -Mailbox [username] | ft DeviceType, DeviceUserAgent, LastSuccessSync in powershell) but I cannot seem to find a way to rule out the Outlook desktop app.

IMAP, POP3, and OWA are disabled for this user per corporate policy so I can rule those out as well.

Is there a way to tell which MAPI clients are or have authenticated with Exchange for a particular user? (This is hosted-exchange on an Office 365 tenant, and I have full admin permissions.)