MCAS: Create Item Impersonated activity

Contributor

Hi Community!

 

Found this activity on one of our users "Create Item (Impersonated)" in Exchange Online. Been looking for a description for this but this is what I found:

Mary_Yvette_0-1592195089246.png

https://docs.microsoft.com/en-us/cloud-app-security/activity-filters-queries

 

Is this caused by Mailbox Delegation in Exchange Online? If yes what activity triggered this?

Would like to know a much detailed description for this activity.

 

Thank you!

1 Reply

@Mary_Yvette Thanks for the question! Check out the impersonated activity in the investigation alerts guide:

 

https://docs.microsoft.com/en-us/cloud-app-security/investigate-anomaly-alerts#unusual-impersonated-...

 

 

www.000webhost.com