Hello,
I administer O365 at my job. At least 2 to 3 times a week (at random times) I'll get an alert email. Here's an example:
A high-severity alert has been triggered
Mailbox Delegation Assignment
Severity:High
Time:9/17/2019 7:00:00 AM (UTC)
Activity:AddMailboxPermission
User:NT AUTHORITY\SYSTEM (Microsoft.Exchange.ServiceHost)
Details: AddMailboxPermission. This alert is triggered whenever someone gets access to read your user's email.
Thank you,
The Office 365 Team
Date:
2019-09-17T06:51:41
IP address:
User:
NT AUTHORITY\SYSTEM (Microsoft.Exchange.ServiceHost)
Activity:
Add-MailboxPermission
Item:
NAMPR17A002.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/ilaniresort.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}
...