APT29 added their own devices as allowed IDs for active sync using "Set-CASMailbox", allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.