The users who are assigned mailbox permissions to access and use mailboxes of other users in the organization are called delegates. The three most generic permissions that can be assigned to users are: Send on Behalf, Send As, and Full Access. The delegates with these permissions can send emails on behalf of a user, as a user, and can even access the designated mailbox directly. Keeping an eye on the activities of the delegates is therefore vital to ensure internal security and proper use of the assigned permissions. This can be done by auditing every change and every action of the delegates.
Using the admin portal in the native tools offered by Microsoft, you might have to use complex PowerShell codes for detailed auditing. M365 Security Plus, a Microsoft 365 auditing, alerting, and monitoring tool, helps you save time by tracking and retrieving the activity logs of delegates as and when required. M365 Security Plus provides a default audit profile called Activities by Mailbox Delegates, which provides one-click access to the required audit data.
Note: Auditing must be enabled first for all the mailboxes to view these audit log. This can be done by clicking on the Enable Now option that appears under the Audit tab.
And that's it. The report gets generated instantly. You can filter the columns required and create a new view if needed.
With the steps given below, you can create and use new audit profiles in M365 Security Plus to get instant updates about various user actions or to track other activities in your Exchange environment.
Learn more about how M365 Security Plus helps simplify complex Microsoft 365 tasks.