Separate account recovery from the investigation
Microsoft’s recovery guidance covers restricting access, revoking sessions and reviewing authentication methods, application permissions, roles, forwarding and inbox rules. Authorised administrators should follow that procedure promptly. Capture suspicious settings when practical without delaying containment. Restoring control and reconstructing earlier activity are separate workstreams. [1]
Define the investigation in business terms. Was a confidential transaction discussed in email? Could an account reach customer files? Were messages sent to colleagues or clients? Identify the affected users, likely services and the period of concern. Include the time before the first alert: detection time is not necessarily the start of access.
Assign one owner to maintain a list of questions and evidence. This prevents a reassuring account-recovery update from becoming an unsupported statement that information was not exposed.
Establish what records still exist
Microsoft Entra sign-in records and the Microsoft 365 Unified Audit Log have different retention arrangements. Microsoft currently lists seven days for ordinary Entra Free sign-in and audit logs, and 30 days for P1 and P2, unless records were retained elsewhere. An upgrade does not restore expired data. Check archived monitoring destinations as well as the portal. [2]
Purview retention depends on licensing, workload and policy. Standard audit records generally have a 180-day default; qualifying Premium records can have longer retention. Confirm the affected users’ entitlements and applicable policies rather than applying the longest advertised period to every account. [3]
Ask for a coverage note alongside the exports: earliest available event, sources searched, missing periods, search filters and collection time. The difference between “no matching activity” and “no records available for that week” can determine how confidently management can describe exposure.
Use sign-ins to identify sessions worth examining
Entra distinguishes interactive user activity, non-interactive activity, service principal activity and managed identity activity. Sign-in details identify the account, client application and target resource. Reviewing only the interactive view can therefore leave relevant activity outside the search. Select the log types appropriate to the suspected access path. [4]
Build a candidate timeline from the account, application, resource, time and available session context. Ask the user and IT team about legitimate travel, remote access and automated applications. Treat an unfamiliar location as a lead requiring explanation, not a reliable identification of a person.
A successful authentication event is not a list of documents read. Use it to direct the workload review. Keep legitimate and suspicious activity distinguishable, and record the reasons for classifying a session rather than labelling every event from an affected account as hostile.
Interpret mailbox access at the right level
Microsoft’s MailItemsAccessed action records access by mail clients and protocols; it does not establish that a person actually read a message. Bind activity can identify individual messages, while sync records identify folders synchronized by supported Outlook desktop clients. Microsoft currently documents this action as enabled by default for users with specified E3/E5 licences. Verify its availability for the actual mailbox. [5]
Synchronization deserves particular care. A downloaded copy can be examined offline without generating further mailbox events. Microsoft’s investigation guidance treats suspicious synchronization conservatively and directs investigators to assess broader mailbox compromise. Do not report an exact number of exposed messages simply by counting visible audit rows. [5]
Give legal and business reviewers an intelligible result: the relevant mailbox or folders, the sensitive material involved and the basis for the exposure assessment. Where only a bounded set of messages can be identified, describe the boundary and its evidential limits.
Follow access beyond email
Review relevant SharePoint and OneDrive activity where the account could reach files. Microsoft distinguishes access, preview, download, sharing and other operations. Their meanings matter: preview and access events do not guarantee a user’s intent, and browser prefetch can produce some preview activity. An audit label should be interpreted using its documented behaviour. [6]
Map activity to the actual business information: project folders, customer records, contracts or shared documents. Ask resource owners to identify sensitivity without circulating a full copy of every document to the response team. Record changes to sharing or permissions separately from evidence of subsequent access.
Extend the review to connected applications or delegated access when evidence points there. A mailbox-only report should not silently become a conclusion about the whole Microsoft 365 environment. Explain which services were reviewed and which remain outside scope.
Use a short evidence checklist
Before the investigation moves into reporting, check whether another authorised reviewer could understand how the findings were produced. A dashboard screenshot alone rarely explains search coverage or lets that reviewer test the same conclusion.
- List the affected identities, business questions and investigation time window.
- Record retention, licensing and any known gaps for each relevant log source.
- Keep original exports with their collection time, time zone and search filters.
- Connect suspicious sessions to mailbox and file activity using available context.
- Separate observed access, potential exposure and actions that cannot be determined.
- Record recovery actions so administrator activity is not confused with earlier misuse.
Make the conclusion useful without overstating certainty
The final report should answer each business question with a finding, supporting evidence, confidence and remaining uncertainty. Use precise language: “these file-download events were recorded” means something different from “these are the only files that could have been obtained.” Absence of an event is meaningful only in the context of known coverage.
Give the relevant legal or privacy advisers the evidence and limitations needed for their assessment. Investigators should not turn incomplete telemetry into a universal promise that notification is unnecessary. Equally, avoid treating every theoretical possibility as an established breach.
Close with practical decisions: which access paths were removed, which information needs further review, and which logging gaps should be corrected. A sound investigation makes the organisation’s next decision clearer, even when the historical record cannot answer every question.
