I am certainly not authoritative, but I don't know of any way to do this. You need access to the Connection logs or the IIS protocol logs, and neither of those are exposed via O365.
From: [email protected] [mailto:[email protected]] On Behalf Of Ramatowski, Paul M.. Sent: Monday, July 6, 2015 4:04 PM To: [email protected] Subject: [Exchange] Exchange Online Audit question On premise, we had local logs to look at when and where connections came from to a mailbox- for example my creds log into my mailbox from home and we could see the connection coming from my ISP's IP address. I have been asked- Is there a way to track where the connection comes from when my creds are used to log into my mailbox in Exchange Online. I've been looking around and best I can tell the answer is still no, as of January 2015 at least on the 0365 message boards. Best I can come up with is a last logon time which isn't helpful in this case. So question is, anyone know of a way this could be done whether third party tools are involved or not, or are we just Out of luck? Thanks, Paul
