Outlook: Multi Account Search

🚨 The Signal: Outlook now allows searching across multiple mailboxes simultaneously. This increases the risk of inadvertent data exposure if users have access to sensitive mailboxes they shouldn't be searching.

The Impact

All users with multiple mailboxes are affected, increasing the risk of accidental exposure of sensitive information across accounts.

• End users: Risk of inadvertently viewing sensitive data from other mailboxes.
• Security teams: Increased surface area for data spillage and compliance breaches.
• Admins: Need to review mailbox access permissions more stringently.
• Compliance officers: Potential for non-compliance with data segregation policies.

The Action

1. Review all mailbox delegation and shared mailbox permissions for least privilege access.
2. Audit existing mailbox access policies to ensure they align with data classification.
3. Implement or reinforce data loss prevention (DLP) policies for Outlook.
4. Educate users on responsible search practices and data handling across multiple accounts.
5. Monitor audit logs for unusual search activity or access patterns across mailboxes.

Domain: Exchange · Impact: high · Workload: Exchange Online