// Microsoft Sentinel / Log Analytics. Read-only; not live-tested.
// Replace the verified UPN; also search historical aliases separately.
let TargetUPN = "REPLACE_WITH_VERIFIED_USER_UPN";
OfficeActivity
| where TimeGenerated between (ago(24h) .. now())
| where OfficeWorkload == "Exchange"
| where UserId =~ TargetUPN or MailboxOwnerUPN =~ TargetUPN
| project TimeGenerated, OfficeId, Operation, ResultStatus, UserId,
    MailboxOwnerUPN, ClientIP, OfficeObjectId, Parameters
| order by TimeGenerated asc
| take 500