It has used a compromised global administrator account in Azure AD to backdoor a service principal with ApplicationImpersonation rights to start collecting emails from targeted mailboxes; It has also used compromised accounts holding ApplicationImpersonation rights in Exchange to collect emails.