Can we find who sent an email (send-as or send-behalf rights) for a shared mailbox?

Hi Priya Jayaraman
I understand you're looking for a way to verify which users are using "Send As" permissions from a shared mailbox. 

Based on my testing, you can achieve this using Audit in the Microsoft Purview portal by following these steps: 

Step 1: Sign in to the Microsoft Purview Portal > go to Solutions > select Audit. 

Step 2: In the Search section: 

+Choose your time range  

+Under Activities (friendly names), select "Sent message using Send As permissions"  

Step 3: Once the search completes, click on the specific search result. 

Step 4: In the Audit search details, you can identify which user used "Send As" permissions. 

+Click into each result 

+Navigate to the SendAsUserSmtp field to identify which shared mailbox was used 

For more details, you can refer to the official documentation: Audit log activities | Microsoft Learn 

I sincerely hope this information partially clarifies your situation and assists you in planning your solution. Please do not hesitate to reply if you have any updates. 

Thank you for your understanding. 

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".         

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.