LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click contacts.. add contacts)
My concern about this is that LinkedIn will not only have access to contacts, but also corporate email as well. (which may contain private or confidential information)
My second concern is that many multi factor authentication systems appear "compatible" with this solution, meaning that the LinkedIn is acting as a MITM
How should I restrict this type of activity from occurring? What IP addresses should I block on the firewall from accessing my Exchange server?
Obviously end users should be informed of this risk and be culturally adapted to not doing such a thing. What is an example communication should I send out that would educate users on not using their corporate credentials on 3rd party sites?