When an account is compromised, this Exchange Online audit record helps establish which messages were read, because it captures sync and bind access through every mail protocol.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains MailItemsAccessed in context, with comparison tables and the common traps.
Terms in this definition
- Exchange Online
Microsoft 365's hosted service for mail, calendars and contacts. Defender for Office 365 protects these mailboxes.
- Audit
Policy effect that lets a request proceed but flags the resource as non-compliant and logs a warning to the activity log. Microsoft suggests beginning there and later moving to something enforcing, like Deny.
- Agents (classic) API
First-generation Foundry Agent Service API, based on threads, messages and runs. It is deprecated, replaced by conversations and responses, and retires on 31 March 2027.
- CRUD
Shorthand for create, read, update and delete, the four basic things you do with data. Data-plane roles in Azure Cosmos DB, for instance, authorise those operations on items.
Related terms
- Microsoft Purview Audit (Premium)
Higher audit tier that retains SharePoint, OneDrive, Exchange and Entra ID records for a year and offers intelligent insights like MailItemsAccessed, plus retention policies reaching 10 years with an add-on.