value:  UNC2452 added their own devices as allowed IDs for active sync using Set-CASMailbox allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.
name: Account Manipulation: Exchange Email Delegate Permissions