Recommended Free Tools
To investigate suspicious mailbox access in Microsoft 365, search Microsoft Purview Audit for MailItemsAccessed over the incident’s UTC time window, then correlate each event with the actor, target mailbox, client, IP address, session, and access type. A Sync record has folder-level scope; a Bind record identifies message access. Neither is proof that a person read a message: Microsoft says Exchange Online can audit access without an indication that the item was read. Microsoft’s MailItemsAccessed investigation guidance explains the operation and its limits.
1. Define the mailbox, time window, and access you need
Before searching, record the affected mailbox or mailboxes, the suspected activity window, and any known suspicious sign-in or related activity. Use UTC for the audit search and compare event times with the incident timeline.
As an Amazon Associate I earn from qualifying purchases.
Confirm that your account has the Microsoft Purview Audit Logs or View-Only Audit Logs role. Searching through Exchange Online PowerShell has its own role requirements. Microsoft lists the relevant access and mailbox-search considerations in its mailbox audit search guidance and audit troubleshooting guidance.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall2. Search for MailItemsAccessed
In Microsoft Purview Audit
- Open Microsoft Purview Audit and set the search start and end times in UTC.
- For an individual user mailbox, select the affected mailbox in the Users filter.
- Select the
MailItemsAccessedoperation and run the search. - Export or record the matching events so you can compare them with sign-in and other mailbox activity.
Microsoft documents both the mailbox filters and the distinction between searching a user’s actions and searching activity against a target mailbox in its mailbox activity search instructions.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
With Exchange Online PowerShell
Search-UnifiedAuditLog can search for the same operation. For a user mailbox, a representative command is:
$startUtc = [datetime]'2026-10-01T00:00:00Z'
$endUtc = [datetime]'2026-10-02T00:00:00Z'
Search-UnifiedAuditLog -StartDate $startUtc -EndDate $endUtc -UserIds '[email protected]' -Operations MailItemsAccessed -ResultSize 1000Replace the sample dates and identity with the incident’s actual UTC range and the relevant user. This is a search pattern, not a guarantee that one query will retrieve every event: verify supported parameters and result handling in your current Exchange Online environment. Microsoft provides the example command and operation details in Use MailItemsAccessed to investigate compromised accounts.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Distinguish folder-level Sync from message-level Bind
| Access type | What the record indicates | How to investigate it |
|---|---|---|
Sync |
A client may have downloaded messages in a folder. The audit record can identify the folder rather than list every message individually. | Assess the mail items in that folder as potentially exposed. Compare the record’s client, IP address, session, user, and protocol context with expected and suspicious activity. |
Bind |
Access to individual messages, identified by their InternetMessageId. Multiple Bind operations may be aggregated into one record. |
Use the message IDs to locate the potentially exposed messages and assess their contents and sensitivity. Do not treat a Bind event as proof a human read the message. |
Microsoft says, “All mail items in the synced folder are assumed to be compromised.” The same guidance notes that Outlook desktop for Windows or Mac may sync a large set of messages. If a client downloads mail and then goes offline, later reading from the local copy is not visible as subsequent mailbox activity. See Microsoft’s description of Sync, Bind, and MailItemsAccessed limitations.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →4. Correlate the event with the incident
Do not judge an event by a single field. Compare its context with known user behavior and the incident timeline; these are investigative axes, not a universal scoring formula.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Evidence | What to compare |
|---|---|
| Time | Does the UTC event time overlap the suspicious sign-in or access window? |
| Actor and mailbox role | Was the actor the mailbox owner, a delegate, or an administrator? |
| Client and protocol | Does ClientInfoString and the protocol context fit the user’s expected client, or is it unfamiliar? |
| Network | Does ClientIPAddress align with known suspicious activity or expected access? |
| Session | Does SessionId connect the event to suspected activity or distinguish it from routine use? |
| Scope | Is the event a folder-level Sync or message-level Bind, and what does that mean for the mail that may be exposed? |
| Follow-on activity | Are there related rule, forwarding, send-as, or deletion events in the same timeline? |
Microsoft identifies these event fields and related mailbox investigation context in its MailItemsAccessed guidance and audit investigation troubleshooting article.
5. Investigate shared mailboxes and delegate activity
A shared mailbox search needs both the target mailbox and the person or service that acted. Searching by a user identity finds activity performed by that user; it does not necessarily return every event that occurred in a particular target mailbox. Conversely, searching for the shared mailbox address as though it were the actor may miss delegate actions.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Search for the actor or delegate as appropriate.
- Search for the target shared mailbox using its primary SMTP address or Exchange GUID in the relevant keyword or free-text field.
- Compare actor, target mailbox, access role, and sign-in type in the returned records.
Microsoft explains the shared-mailbox search fields and actor-versus-target limitation in its shared mailbox audit guidance and mailbox activity search instructions. Check whether the relevant action is audited for that access role and sign-in type.
Look for related operations
Depending on the suspected behavior, search for FolderBind, SendAs, New-InboxRule, Set-InboxRule, Set-Mailbox, SoftDelete, or HardDelete alongside MailItemsAccessed. Rule events can reveal mail being hidden or redirected; Set-Mailbox activity may help investigate forwarding configuration. The relevant operations and shared-mailbox checks are documented in Microsoft’s shared mailbox investigation guidance.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
6. If the search returns no records
An empty result does not establish that no mailbox access occurred. Check these causes before drawing a conclusion:
- Permissions: verify the investigator has an appropriate Purview audit role and, for PowerShell, the required Exchange Online role assignment.
- Filters: confirm the UTC range, operation, and identity filters. For shared mailboxes, check both the actor and the target mailbox search rather than relying on one identity filter.
- Audit configuration: review tenant-level and mailbox-level audit settings. Microsoft documents cases where mailbox audit events for non-E5 users may not appear in unified audit searches and describes manual mailbox auditing as a workaround. Follow your organization’s procedures before changing audit settings.
- License and policy: confirm the affected user’s licensing and the tenant’s applicable audit retention policy.
- Retention: establish whether the event is still within the period for which records are retained.
Microsoft’s troubleshooting guidance covers role, configuration, and search limitations, including the non-E5 scenario: Search the audit log to investigate common support issues.
7. Check retention before treating absence as evidence
Microsoft Purview Audit Standard retains applicable records for 180 days by default when they were generated on or after October 17, 2023; older Audit Standard records are retained for 90 days. Audit Premium provides retention policies and longer retention options: Microsoft documents up to one year for specified Exchange, SharePoint, OneDrive, and Microsoft Entra audit records under the applicable default policy, and up to 10 years with the required add-on license and an appropriate policy. These periods depend on licensing and policy; retention changes do not restore records that have already expired. Verify the affected user’s license and the tenant’s actual policy. Details are in Microsoft’s overview of Purview auditing solutions.
8. Preserve the distinction between access evidence and proof of reading
MailItemsAccessed is evidence of audited mailbox access and its recorded context, not proof that a person read a particular message. Microsoft states that Exchange Online audits an event when an attacker gains access to a mail item even when there is no indication the item was read. For Sync, investigate the folder’s contents as potentially compromised; for Bind, use the recorded message IDs to identify the messages whose exposure needs assessment. Microsoft recommends using these audit records for forensic investigation after the breach has been resolved and the bad actor evicted. They should be interpreted within the wider containment and evidence-preservation process. Microsoft’s investigation guidance describes both the event semantics and this forensic context.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
