Microsoft 365 forensics is the collection and analysis of evidence from Microsoft cloud services to understand account activity, mailbox access, administrative changes, file access, sharing, authentication, application consent, and potential data exposure. It commonly involves Microsoft Entra ID, the Unified Audit Log, Exchange Online, SharePoint, OneDrive, Defender signals, and tenant configuration records.
Core Evidence Sources
In Azure & Microsoft 365 Incident Response, Microsoft Entra ID sign-in logs can show authentication attempts, device and location context, application access, conditional access outcomes, and MFA-related details. Entra audit logs can show changes to users, groups, applications, credentials, roles, and policies. These records help distinguish expected activity from suspicious account use.
The Microsoft Purview Unified Audit Log can contain user, admin, Exchange, SharePoint, OneDrive, Teams, and other workload events, depending on licensing, configuration, and retention. Exchange Online evidence may include mailbox audit events, inbox rules, forwarding settings, message traces, delegate access, and suspicious search or export activity. SharePoint and OneDrive logs may show file access, downloads, external sharing, synchronization, link creation, and permission changes.
Mailbox and Identity Abuse
Microsoft 365 forensics is often central to business email compromise. Investigators may look for suspicious sign-ins, impossible travel, legacy authentication, unfamiliar applications, malicious inbox rules, external forwarding, MFA changes, OAuth consent, or administrative actions. If session hijacking is suspected, token and device context become important because an attacker may not need to repeatedly enter a password.
Limits and Retention
Microsoft 365 does not guarantee that every event needed for an investigation will exist. Log availability can depend on licensing, audit configuration, retention settings, workload behavior, and time elapsed. Some events show that a file was accessed or downloaded; others may show only authentication to an application. Some mailbox details require mailbox auditing to have been available and retained.
Good findings therefore describe the specific logs reviewed, the relevant retention windows, and any gaps. A report should not claim that no access occurred simply because a log source is silent if the source was not enabled, was outside retention, or does not record the relevant event type.
How It Supports Decisions
Microsoft 365 forensic analysis can help determine whether accounts were compromised, what data may have been exposed, whether mail was manipulated, whether cloud files were shared or downloaded, and what controls should be improved. It also supports containment steps such as revoking sessions, resetting credentials, reviewing OAuth applications, disabling forwarding, tightening conditional access, and preserving logs before they expire.