Using Delegation with Exchange & M365

Forensic Email Collector (FEC) allows you to connect to a target Exchange mailbox using another user’s (e.g., an administrator) credentials who has full mailbox access rights to the target mailbox. If your admin user does not have full mailbox access rights, the target Exchange server would likely return an error message along the lines of “The specified object was not found in the store. The process failed to get the correct properties.”

In order to use delegation with Exchange / Office 365:

1. Enter the target email address (this is the mailbox you wish to forensically preserve).

2. Enter the username and password for the account that has the permissions needed to access the target mailbox. In this case, instead of entering the credentials of [email protected], we are using the credentials of [email protected].

   Important Note

   M365 tenants no longer accept basic authentication. Therefore, when acquiring mailboxes from M365, you should keep the Use OAuth option checked at this stage. You can log in as the admin user when the modern authentication window pops up later in the workflow when FEC populates the folder tree.

3. When you use a different set of credentials than those of the target mailbox, FEC will automatically switch to delegation mode and allow you to acquire the mailbox.