Is Audit log User signed in to mailbox broken, I got a result for one mailbox in a 4 hrs workshift of 262 logins?!
Is Audit log "User signed in to mailbox" broken, I got a result for one mailbox in a 4 hrs workshift of 262 logins?!
[Deleted User] commented
Found this via google looking for a solution for the same issue.
In my case the 'issue' is Mac/mail related. When a Mac user uses the program 'mail' to connect to a O365 account, it will record dozens of (successful) mailbox sign in's per second. Personally i work on a Mac as well, but use Outlook for Mac and i do not have this sign in's in the audit log.
Can you confirm that the user did actually log in this many times (ask him or her)? Or is there any additional evidence of a brute force attack or some other security incident unfolding?