How to Investigate a Security Alert for a New Mailbox Delegation

A mailbox delegation can provide legitimate coverage or enable someone to read and send messages without using the mailbox owner’s password. Unexpected delegation may expose sensitive communications.

What to check

Check who granted access, delegate identity and permissions, approval, creation time, subsequent mailbox activity, and related sign-ins. Review audit records for both the mailbox and delegate account.

Recommended next step

Confirm business purpose with the mailbox owner, remove unapproved access, and assess messages accessed or sent. Preserve logs and review other mailboxes if the change came from a broader compromised account.

How Informatix Systems can help

Informatix Systems provides security operations and email security services. We can review the environment, trace the problem through its dependencies, and help plan a practical resolution. Contact us with the system involved, when the issue began, and non-sensitive error details.