Office 365 Potential Glitch

[Achandler]

A situation has arisen today where an ex-member of staff has managed to access their emails, even after there password has been reset.

 

For example, I reset the password on a member of staff account at 12:12pm. So the account password was now only known to me, however, three emails recieved after this time (between 12.40 and 14.01) have been deleted, and are now in the deleted items folder. The ex member of staff has an iPad, so I am rightly or wrongly assuming that this issue may be to do with the account being on this, even though the password has been changed.

 

It isn't the first time I have seen a memeber of staff not need to update the password on an iPad/ iPhone even when they have updated it on Outlook and need the new one to access the emails via Outlook Web Access.

 

Disabling the account, I assume would stop access but haven't tested it.

 

If the above about password changes is true, then it represents a flaw should an iPad be stolen, or account passwords just be reset and not disabled.

[Steve21]

When you say changed how did you change it? As if it's an AD password don't forget it only syncs up to MS when Dirsync runs etc

 

Steve

[RichCowell]

How regularly is Office 365 syncing with your AD? Could it just be that the password reset hadn't synchronised?

[Achandler]

It doesnt sync, seperate passwords, reset using Office365. have the email to prove it, and even tested to make sure the password had updated to the new one.

[Steve21]

Seems it's "by design and always has been the case and can be up to 72 hours

 

http://blogs.technet.com/b/messaging_with_communications/archive/2012/06/27/part-ii-outlook-amp-owa-disabled-accounts-and-users-still-being-able-to-access.aspx

 

-Side note, even says don't use password resets as a lockout method in some of the bits I read

 

Steve

[RichCowell]

Seems it's "by design and always has been the case and can be up to 72 hours

 

http://blogs.technet.com/b/messaging_with_communications/archive/2012/06/27/part-ii-outlook-amp-owa-disabled-accounts-and-users-still-being-able-to-access.aspx

 

-Side note, even says don't use password resets as a lockout method in some of the bits I read

 

Steve

 

How daft!

 

Sounds like setting the "Set sign-in status" in the user's settings to Blocked is the only way to ensure access is denied... it's done automatically when an AD account is disabled if it's synchronised (and not changed back when re-enabled)...

Edited July 10, 2015 by RichCowell

[Achandler]

It's a bit of a farce really, i'll manaully disabled everything. Evene having read that article, I still don't think it is by design, just badly designed.

[Cache]

you could try removing the mobile device from the mailbox too and see if that disables the sync and ability to access it too.

 

ECP -> Recipents -> Find Mailbox -> then try either disable activesync/disable owa for devices and if you view details, you'll be able to delete the devices permission to access the mailbox too (or wipe data, but I'm not 100% sure if that's the device or just the mailbox data)