3

An email was sent on behalf of another user that should not have been sent. Multiple people have this permission. How do I find out who sent the email? Assume it's been deleted from sent items. Using Office365 hosted exchange.

Simkill
  • 235
  • 1
  • 3
  • 10

2 Answers2

1

If you have audit log enabled (it isn't by default) in the security and compliance centre it tells you this information.

https://support.office.com/en-us/article/Search-the-audit-log-in-the-Office-365-Security-Compliance-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c

Lake29
  • 41
  • 3
  • You must also enable mailbox auditing, and set the actions to be audited. SendAs and SendonBehalf are auditabled actions. This is set on a per mailbox basis, and must explicitly be enabled, and it is not retroactive. You shoudl be able to get the support article by searching for exchange online mailbox auditing ( https://www.bing.com/search?q=exchange+online+mailbox+auditing&form=EDGTCT&qs=PF&cvid=28e9d736df02494ba167e79ee15a44e6&refig=d43938ae570544f4c8c343cdd496d31e&cc=US&setlang=en-US ) – Jesus Shelby Aug 05 '18 at 22:38
0

You will want to run a message trace from the Office 365 administration center. Note that there are different instructions for emails that are either under or over 7 days old.

Mark Henderson
  • 68,823
  • 31
  • 180
  • 259
  • Message trace doesn't give me the required information. Message trace tells me the mailbox that was used 'on behalf of', not the person who sent the message. E.g. User A sends a message on behalf of User B. Message trace shows email went out from User B and nothing about User A. – Simkill Aug 02 '18 at 15:18