How can I tell if a user has more than one computer logging with Outlook?

One way to do this would be to navigate to the Security and Compliance center in your Office 365 tenant, navigate to Search, then to Audit log search, then do a search for "User signed into mailbox" (under Activities>Exchange Mailbox activities) and focus the search on your user. Look for the ip address your user has signed in from. If you've disabled all but Outlook desktop (MAPI) then any logins you see can only be from the Outlook client. If you see ip addresses other than your company ip address than that's an indication that the user is using Outlook to access their mailbox from locations other than the company network.

Another way to do it would be to navigate to the Azure AD admin center, navigate to Users, then to Sign-ins, and filter the sign-ins log for your user and for the client app. You can filter on several modern auth and legacy auth clients to narrow it down to what you're looking for. Once you find the activity, again look at the ip addresses associated with the activity and deduce from there.


Agree with joeqwerty, you could use the Audit Log search feature in office 365 to search the entries about the login records.

Besides, maybe the Mailbox Audit Log could help you trace the client access too, and you could run the following command to enable it, then run a non-owner mailbox access report to view the mailbox actions(Here is a guide about Mailbox Audit Logging for your reference, it should be suitable for Exchange Online too: Mailbox audit logging in Exchange 2016):

Set-Mailbox -Identity "<Mailbox Name>" -AuditEnabled $true

Hope the above information is helpful to you.