Mailbox auditing allows you to discover illicit activities performed in an Exchange Online mailbox, whether by an attacker because of a compromised account or by a malicious insider who has delegate access.

Using legacy authentication may, in some circumstances, increase the risk of account compromise due to how the password is transmitted and stored.