Investigating M365 and Entra ID

M365/Entra investigations differ from on-premises DFIR -- there are no disk images, no memory dumps, and no event logs you can collect yourself. Everything comes from API queries against Microsoft's log stores, several of which require E5 licensing or advanced audit to retain what you need. Knowing which logs exist, which ones are missing, and how long they last is half the investigation.

When to Use

• Business email compromise (BEC) -- unauthorized mailbox access, forwarding, or impersonation
• Entra ID account compromise -- suspicious sign-ins, token replay, credential stuffing
• Suspicious OAuth consent grants -- third-party apps with excessive permissions
• Mailbox rule manipulation -- inbox rules hiding attacker communications or forwarding mail
• Azure AD sign-in anomalies -- impossible travel, legacy auth, anonymizer networks
• Conditional Access or MFA tampering -- policy changes, MFA fatigue attacks

When NOT to Use