Using Delegation with Exchange & Office 365

Forensic Email Collector allows you to connect to a target Exchange mailbox using another user's (e.g., an administrator) credentials who has full mailbox access rights to the target mailbox. If your admin user does not have full mailbox access rights, the target Exchange server would likely return an error message along the lines of "The specified object was not found in the store. The process failed to get the correct properties."

In order to use delegation with Exchange / Office 365:

1. Enter the target email address (this is the mailbox you wish to forensically preserve):

2. Enter the username and password for the account that has the permissions needed to access the target mailbox. In this case, instead of entering the credentials of jane.doe@example.com, we are using the credentials of admin@example.com.

NOTE: You do not have to uncheck the "Use OAuth 2.0" option at this stage. You can keep it checked and log in as the admin user when the modern authentication window pops up later in the workflow when FEC populates the folder tree.

3. When you use a different set of credentials than those of the target mailbox, FEC will automatically switch to delegation mode and allow you to acquire the mailbox.