Microsoft 365 and Exchange Online forensics
When a mailbox is taken over, a payment is redirected or an employee leaves with more than they should, the answers are in your Microsoft 365 tenant's logs. We preserve them, read them in context and tell you what happened, what was exposed and what to fix.
Reviewed by the ITRS security team · Last updated
When you need a tenant investigation
Most email incidents start small: a client asks why your banking details changed, or a user notices replies they never sent. Resetting a password ends the immediate access but answers none of the questions that matter afterwards. Who got in, how, for how long, what did they read or send, and does anyone need to be notified?
A forensic investigation of the tenant answers them with evidence you can show a bank, insurer, regulator or court.
- Business email compromise, where an attacker uses a real mailbox to send fake invoices or change payment instructions
- Mailbox takeover after phishing, password reuse or an MFA prompt the user approved by mistake
- Wire-fraud attempts, successful or not, where you need to show your bank and insurer how it happened
- Insider and departing-employee concerns, such as mail forwarded to a personal account or bulk access to files before a resignation
- Privacy complaints or breach assessments where you must establish whether personal information was accessed
What we examine
Microsoft 365 records a great deal, but across several portals with different retention rules and licensing. We collect from each source, normalize timestamps to UTC and read them together.
| Evidence source | What it helps establish |
|---|---|
Unified Audit Log (Microsoft Purview Audit) | Mailbox, SharePoint, OneDrive, Teams and admin activity across the tenant, including rule changes, permission grants and file access |
Microsoft Entra ID sign-in logs | Who signed in, when, from which IP address and client application, and whether MFA was satisfied or bypassed |
Microsoft Entra ID audit logs | Directory changes: new authentication methods, role assignments, password resets, app registrations |
MailItemsAccessed mailbox auditing | Which folders were synced and which individual messages were opened, by protocol and client, during the access window |
Inbox rules and mailbox forwarding | Rules that hide, delete, move or forward mail, and forwarding addresses set on the mailbox |
Exchange transport (mail flow) rules | Organization-wide rules an attacker with admin access could add to copy or redirect mail |
App consents and service principals | Third-party or malicious OAuth apps granted access to mail or files, and who consented |
Message trace | Messages sent and received by the mailbox, including fraudulent emails to clients or vendors |
Microsoft Defender alerts and incidents | Alerts already raised on suspicious sign-ins, rules or malicious messages, where the tenant is licensed for them |
Mailbox content via eDiscovery | The messages themselves, preserved and searched without altering the mailbox |
How an engagement runs
Preserve
We place eDiscovery holds on affected mailboxes and OneDrive accounts and export audit and sign-in data before it ages out. If containment has not happened, we coordinate it so evidence is recorded before rules or apps are removed.
Collect
Using tightly scoped administrative access, we export audit records, Entra ID logs, mailbox configuration, transport rules, app consents and message trace results, with hashes and a collection log.
Analyze
We identify the first malicious sign-in, how access was gained, every IP address and session tied to the attacker, and every change made inside the tenant. MailItemsAccessed and file activity records tell us what the attacker could have read.
Build the timeline
Events from every source are merged into a single UTC timeline, from initial access through containment, so each finding can be traced to the underlying record.
Report
You receive a written forensic report with findings, the timeline, the scope of data exposure and our methodology, written for executives, counsel and insurers.
Remediate
We close the gaps the attacker used: remove persistence, revoke sessions and tokens, tighten app consent and forwarding controls, and review MFA and Conditional Access, either directly or as a checklist for your IT provider.
What you receive
The core deliverable is a forensic report that stands on its own: plain-English findings first, then the evidence behind each conclusion, with record identifiers another examiner could check.
You can see the structure in our sample incident response report. Where a matter is heading toward litigation, the report can be prepared at the direction of counsel, and expert-witness support is available.
- Executive summary: cause, duration and impact
- Timeline of attacker activity in UTC
- Mailboxes, messages and files accessed, and the basis for each conclusion
- Fraudulent messages sent and their recipients
- Persistence found and removed
- Facts counsel needs for a breach assessment
- Prioritized remediation and chain-of-custody record
Why speed matters
Microsoft 365 logs do not last forever. Microsoft's documentation lists 180 days as the default retention for Audit (Standard) records, with one year for Exchange, SharePoint, OneDrive and Entra records generated by users with E5 or equivalent audit licensing. Entra ID sign-in and audit logs are kept for far less: seven days on the free tier and 30 days with Entra ID P1 or P2, unless they are exported to storage. Upgrading a licence after the fact does not bring back records that have already expired.
Evidence can also be lost through good intentions. Deleting a forwarding rule, removing an app or wiping a laptop before anything is recorded can erase the facts that show how the attacker operated. Call before you clean up, or at least export and screenshot what you can first.
Frequently asked questions
Often, yes. Where MailItemsAccessed auditing was enabled, the records show which folders were synced and which individual messages were opened. Where it was not, we work from sign-in sessions, message trace and other audit events, and state our conclusions with the right level of confidence.
No. A reset ends one route of access, but earlier logs remain until their retention period ends. Tell us what has changed, and avoid further cleanup until evidence is preserved.
We ask for the least access needed to collect the evidence, usually audit and eDiscovery roles plus read access to Entra ID logs. Every account and action we use is recorded in the collection log.
Yes. Our report sets out what personal information was in the affected mailboxes and files and what evidence shows was accessed. Counsel uses those facts to assess whether the breach meets a reporting threshold. The assessment itself is a legal decision we support, not one we make.
Yes. Administrators can review audit logs, mailbox configuration and eDiscovery searches without notifying the user. We agree the scope with you and your counsel first so the work stays proportionate.
Related work.
- Case studyFrom Breach Forensics to a Company-Wide Identity PlanFrom reconstructing a 2018 mailbox compromise minute by minute to scoping centralized Entra ID and Intune management for a 40 to 50 person pharma firm.
- Case studyCleaning Up a Microsoft 365 Tenant for a Fire Protection & Security CompanyHow IT Rapid Support audited every Microsoft 365 group for a GTA fire protection company, fixed mail routing, and cut an 82,456-item mailbox by 62%.
Related.
- GuideUsing the Microsoft 365 audit log in an investigationAlmost every Microsoft 365 investigation comes down to the audit log: who signed in, what they read, which rule they created, what they sent.
- GuideWhat to do if a Microsoft 365 account is hackedAn admin's step-by-step for a compromised Microsoft 365 mailbox. The order matters: lock the attacker out first, record what they did, and only then clean up.
- GuideFinding and blocking malicious mailbox forwarding rulesAfter an attacker gets into a mailbox, one of the first things they do is set up a rule: forward anything mentioning 'invoice' to an outside address, or move replies…
- GuideControlling OAuth app consent in Microsoft 365Consent phishing doesn't steal a password. It tricks a user into clicking 'Accept' on a real Microsoft permission prompt for an attacker's app, which then reads mail and…
- ServiceIncident ResponseA 24/7 line to responders who contain first, preserve evidence second and explain everything.
- ServiceDigital ForensicsForensic acquisition and analysis of laptops, phones, mailboxes and cloud tenants, with chain of custody.
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.