MICROSOFT CLOUD INCIDENT RESPONSE & FORENSICS
Microsoft 365 & Azure
Incident Response.
Cyber Centaurs investigates suspected Microsoft 365, Entra ID, Exchange Online, and Azure compromises to reconstruct unauthorized activity, identify affected identities and cloud resources, evaluate persistence and data access, and provide organizations and counsel with defensible findings for containment and recovery.
24/7 Incident Response
WHEN TO ENGAGE
When the Compromise
Extends Into the Cloud.
Microsoft cloud incidents may begin with a compromised user account but extend into privileged identities, mailbox activity, cloud storage, applications, administrative settings, or other tenant resources. Investigation can help establish the scope before remediation changes or retention limits reduce the available record.
Suspicious Entra ID Sign-Ins
Compromised User or Admin Accounts
Unexpected MFA or Identity Changes
Malicious OAuth / Application Activity
SharePoint or OneDrive Data Access
Unauthorized Exchange or Tenant Changes
RESPONSE OBJECTIVES
Secure the Identities.
Preserve the Cloud Record.
Microsoft cloud response should reduce ongoing unauthorized access while preserving the authentication, identity, application, email, storage, and administrative evidence required to understand the compromise.
Contain Access
Support revocation of unauthorized sessions, credential remediation, MFA review, application access review, and other actions needed to reduce continued threat-actor access.
Preserve Evidence
Protect relevant Entra ID, Microsoft 365, Exchange, SharePoint, OneDrive, application, endpoint, and security records before retention or remediation changes the available evidence.
Reconstruct Activity
Develop timelines of authentication, session activity, identity changes, mailbox access, cloud-file activity, application consent, and administrative actions.
Establish Scope
Determine affected identities, accounts, applications, cloud resources, data sources, persistence mechanisms, and the supported impact of the compromise.
CLOUD INVESTIGATION EVIDENCE
Evidence Across the
Microsoft Environment.
Microsoft cloud investigations require correlation across identity, email, applications, cloud storage, administrative records, endpoints, and security telemetry. No single log source typically provides the complete picture. Broader incident work may also require data breach investigation and incident response.
Entra ID & Authentication
sign-in records
MFA events
session activity
conditional access
identity changes
privileged access
Exchange Online
mailbox audit activity
message activity
inbox rules
forwarding
mailbox settings
SharePoint & OneDrive
file access
downloads
sharing activity
synchronization
cloud storage
audit records
Applications & OAuth
enterprise applications
application consent
OAuth permissions
service principals
connected applications
application activity
Administrative Activity
role changes
tenant configuration
security settings
account changes
policy changes
administrative audit records
Endpoints & Security Telemetry
browser artifacts
endpoint activity
EDR / XDR
security alerts
credential artifacts
INVESTIGATIVE QUESTIONS
What Happened Across
the Tenant?
A Microsoft cloud investigation should determine more than whether a single account was compromised. The objective is to reconstruct the broader identity and cloud activity and establish what the available evidence supports concerning persistence, privilege, data access, and impact. A business email compromise investigation may be one subset of this broader tenant-level work.
Which Identities Were Compromised?
Evaluate authentication, session, MFA, account, and security records to identify users or privileged identities implicated by the available evidence.
How Did Unauthorized Access Develop?
Examine available evidence concerning credential compromise, phishing, session or token theft, malicious applications, password reuse, endpoint compromise, or other access mechanisms.
Was Privileged Access Obtained?
Identify role assignments, administrative activity, privileged-account use, permission changes, or other evidence of elevated access.
Was Persistence Established?
Evaluate application consent, forwarding rules, additional accounts, authentication methods, session activity, configuration changes, or other mechanisms that may have supported continued access.
What Cloud Data Was Accessed?
Examine available evidence concerning Exchange, SharePoint, OneDrive, cloud applications, files, communications, and other resources accessible through affected identities.
What Is the Supported Tenant Scope?
Correlate identity, email, cloud, application, administrative, endpoint, and security evidence to distinguish confirmed activity from unresolved questions.
MICROSOFT CLOUD RESPONSE PROCESS
Contain the Access.
Reconstruct the Activity.
The response process is structured to establish control over affected identities, preserve cloud evidence, investigate unauthorized activity, determine tenant-level scope, and support remediation according to what the available technical record supports.
01
Triage & Secure
Identify known affected identities, understand actions already taken, assess current sessions and access, and establish immediate containment priorities.
02
Preserve & Collect
Collect relevant Entra ID, Microsoft 365, Exchange, SharePoint, OneDrive, application, endpoint, security, and administrative records.
03
Analyze Cloud Activity
Examine authentication, sessions, MFA, mailbox activity, application consent, cloud-file activity, role changes, and other evidence associated with unauthorized access.
04
Correlate & Determine Scope
Develop timelines, identify affected identities and resources, evaluate persistence and data access, and establish the supported scope and impact.
05
Remediate & Report
Provide findings relevant to credential and identity remediation, application cleanup, security controls, recovery decisions, and communication with leadership, counsel, or other authorized stakeholders.
IDENTITY & PERSISTENCE
Access Can Persist
After a Password Reset.
Changing a password may not address every mechanism available to a threat actor. Cloud investigations should consider sessions, authentication methods, application permissions, mailbox configuration, privileged roles, and other mechanisms that may allow continued or renewed access.
Active Sessions & Tokens
Review relevant session activity and token-related evidence where available.
MFA & Authentication Methods
Evaluate unexpected authentication registrations, MFA events, or changes to identity-verification methods.
OAuth & Enterprise Applications
Identify suspicious application consent, permissions, service principals, or connected applications.
Mailbox Persistence
Review forwarding rules, inbox rules, delegated access, redirects, and other mailbox configuration.
Privileged Roles
Evaluate role assignments, administrative permissions, elevated account activity, and other privilege changes.
Tenant Configuration Changes
Identify relevant security, identity, policy, or administrative changes associated with the compromise.
CLOUD DATA EXPOSURE
Determine What the
Compromised Identity Could Reach.
A compromised Microsoft identity may provide access to far more than email. Depending on permissions and configuration, the affected account may expose cloud files, collaboration environments, applications, business communications, and other organizational information.
Email & Attachments
Evaluate relevant Exchange activity, communications, attachments, and mailbox evidence.
SharePoint & OneDrive
Assess available records concerning file access, downloads, sharing, synchronization, and other cloud-storage activity.
Connected Applications
Review authorized applications and services that may extend access beyond the core Microsoft environment.
Supported Exposure Scope
Document confirmed access, potential exposure, evidentiary limitations, and resources for which the available record cannot establish activity conclusively.
WHY CYBER CENTAURS
Technical Depth.
Investigative Judgment.
Cloud incidents require more than a sign-in log.
Cyber Centaurs combines incident response, digital forensics, identity investigation, and Microsoft cloud expertise to reconstruct complex account and tenant activity and provide findings grounded in the available technical record.
Microsoft Cloud Investigation
Technical analysis across Entra ID, Exchange Online, SharePoint, OneDrive, applications, identity, and related evidence sources.
Evidence Correlation
Authentication, cloud, mailbox, administrative, endpoint, and security records are analyzed together rather than interpreted in isolation.
Persistence & Scope Analysis
The investigation evaluates identity changes, applications, sessions, privileges, mailbox configuration, and other activity relevant to continued access and tenant scope.
Support for Leadership & Counsel
Technical findings are communicated clearly to executives, legal counsel, IT/security teams, insurers, and other authorized stakeholders.
MICROSOFT 365 INCIDENT RESPONSE FAQ
Practical Questions
After a Cloud Compromise.
Microsoft cloud incidents can involve identity, email, applications, storage, administrative activity, and endpoints at the same time. These questions address common considerations during the initial investigation and response.
What should we do after discovering a compromised Microsoft 365 account?
Take reasonable steps to reduce continued unauthorized access, including reviewing active sessions, credentials, MFA, authentication methods, application access, and other persistence mechanisms. Preserve relevant Entra ID, mailbox, cloud, endpoint, and security records before remediation or retention changes the available evidence.
Is resetting the user's password enough?
Not necessarily. Depending on the compromise, additional access may involve active sessions, authentication methods, OAuth applications, mailbox forwarding, delegated access, privileged roles, or other configuration. The appropriate remediation depends on the activity identified and the tenant's configuration.
Can you determine how the Microsoft 365 account was compromised?
Cyber Centaurs evaluates available evidence concerning phishing, credential compromise, suspicious authentication, session or token activity, malicious applications, password reuse, endpoint compromise, and other potential access mechanisms. Whether a specific entry method can be established depends on the evidence retained.
Can you determine what files were accessed in SharePoint or OneDrive?
Available Microsoft audit records may provide evidence concerning file access, downloads, sharing, synchronization, and other cloud-storage activity. The level of detail depends on licensing, audit configuration, retention, and the records available for the relevant time period.
Can you identify malicious OAuth or enterprise applications?
Yes. Microsoft cloud investigations may include review of enterprise applications, OAuth permissions, consent activity, service principals, connected applications, and other application-related evidence relevant to unauthorized access or persistence.
Can you determine whether an administrator account was compromised?
Authentication, privileged-role activity, administrative audit records, security telemetry, configuration changes, and other evidence may help establish whether an administrative identity was involved and what actions occurred.
Is Microsoft 365 compromise the same as business email compromise?
Not necessarily. Business email compromise often centers on unauthorized mailbox access, impersonation, and fraud. A broader Microsoft 365 compromise may involve identity, privileged access, cloud storage, applications, tenant configuration, and other resources beyond email.
Can Microsoft 365 incident response be performed remotely?
Yes. Microsoft cloud investigations are commonly performed remotely through authorized access to tenant logs, audit records, cloud evidence, security telemetry, and related sources. Endpoint evidence may also be collected remotely where appropriate.
CONFIDENTIAL INQUIRY
Speak With an
Incident Response Investigator.
Tell us briefly about the suspected Microsoft 365 or Azure compromise, affected users or accounts, activity observed, and the assistance you need. A member of the Cyber Centaurs team will review your inquiry and follow up directly.
Confidential inquiry. Please do not submit credentials, access tokens, sensitive emails, tenant exports, or evidence through this form.