Embed Notice

@GossiTheDog @alex -- I don't think this was from: Spraying M365 Mailbox accounts... Reading between those lines, "Non-Prod-Test-Tenant Account" That sounds a whole lot more like a 'Service Account/Machine Account" used for a Proof of concept tool/service; automation accounts aren't going to have MFA.

There are a great many different services/tools that are granted delegated access to various different things, email being accessed sounds to me that perhaps it was an automation service meant to trigger actions based on access to mail content/interaction.