Could an administrator generate activity on behalf of another user?¶

Yes. Administrators can access or change another user's account, mailbox, device or data. A log may record the privileged actor, the target user, an effective identity - or only part of that relationship.

Delegation can obscure the visible actor¶

Support and administration functions include password resets, mailbox access, impersonation, permission changes, remote commands and file restoration. Temporary roles, service accounts and “run as” mechanisms can make activity in the target environment resemble ordinary user action.

Field definitions matter: an actor normally performs the operation, while a target is affected by it, but products use different names and may omit one layer from application logs.

Establish identity, authority and method separately¶

Preserve privileged audit and authentication records, role assignments, remote-access sessions, support tickets and approvals. Determine whether the administrative account was personal or shared and whether elevation was active for the event.

Technical permission does not prove authorised purpose, just as the target user's name does not prove their involvement. A narrow conclusion identifies who or what account exercised the privilege, what resource changed and how; legitimacy and personal attribution need their own evidence.