/investigating-m365-entra

name: investigating-m365-entra
description: Investigate security incidents in Microsoft 365 and Entra ID (Azure AD) -- search the Unified Audit Log, correlate sign-in and audit events, trace illicit OAuth consent grants, analyze mailbox rule manipulation, and contain compromised identities. Use when responding to a BEC incident, investigating Entra ID compromise, analyzing suspicious OAuth app permissions, tracing mail forwarding abuse, or reviewing Azure AD sign-in anomalies.
verified: 2026-07-27

Investigating M365 and Entra ID

M365/Entra investigations differ from on-premises DFIR -- there are no disk images, no memory dumps, and no event logs you can collect yourself. Everything comes from API queries against Microsoft's log stores, several of which require E5 licensing or advanced audit to retain what you need. Knowing which logs exist, which ones are missing, and how long they last is half the investigation.

When to Use

• Business email compromise (BEC) -- unauthorized mailbox access, forwarding, or impersonation
• Entra ID account compromise -- suspicious sign-ins, token replay, credential stuffing
• Suspicious OAuth consent grants -- third-party apps with excessive permissions
• Mailbox rule manipulation -- inbox rules hiding attacker communications or forwarding mail
• Azure AD sign-in anomalies -- impossible travel, legacy auth, anonymizer networks
• Conditional Access or MFA tampering -- policy changes, MFA fatigue attacks

When NOT to Use

• **Broader incident response methodology** -- use `responding-to-incidents`
• **Offensive testing of Entra ID** -- use `attacking-entra-id`
• **An Azure resource/subscription compromise** -- use `investigating-azure-incidents`
• **An AWS compromise** -- use `investigating-aws-incidents`
• **Other cloud infrastructure (GCP, offensive testing)** -- use `exploiting-cloud-platforms`
• **Building detection rules from findings** -- use `engineering-detections`

Log Landscape and Retention

Before you query anything, establish what you have and how far back it goes. Missing logs are a finding, not a reason to skip the question.

| Log source | Retention (default) | License gate | Key operations | | --- | --- | --- | --- | | Unified Audit Log (UAL) | 180d default; 1 year for E5-licensed users | MailItemsAccessed requires E5 | MailItemsAccessed, New-InboxRule, Set-Mailbox, consent grants | | Entra ID sign-in logs | 30d | Export to Log Analytics for longer | Sign-in events, CA evaluation, MFA results | | Entra ID audit logs | 30d | None | Role assignments, app registrations, credential changes | | Identity Protection | 30d | Requires P2 | Risky sign-ins, risk detections | | Defender for Cloud Apps | 180d | Requires MDCA license | Activity log, OAuth app inventory | | Mailbox audit log | 90d (on by default) | MailItemsAccessed requires E5 | Mail access, send-as, delegate ops |

**Get the retention right before you conclude anything from a gap.** Since 17 October 2023 the Audit (Standard) default is **180 days**, not the 90 days most older material still cites — records generated *before* that date kept the old 90-day window. One year is the default only for users holding an E5 (or Purview Audit add-on) licence, and even then only for Exchange, SharePoint, OneDrive, and Entra ID. An E3 tenant therefore has 180 days of UAL and no `MailItemsAccessed`, and cannot extend retention in-product.

Retention is per-user by licence, not per-tenant: in a mixed tenant the same query can return a year of history for an E5 custodian and 180 days for the E3 account next to them. Confirm the licence on the account you are investigating before you read an empty result as "no activity". State that gap explicitly. Check SIEM or Log Analytics for extended retention.

Unified Audit Log (UAL)

The UAL is the single richest data source. Every investigation starts here.

Connect-ExchangeOnline -UserPrincipalName admin@tenant.onmicrosoft.com

# Basic search -- always constrain by date and user
Search-UnifiedAuditLog -StartDate "2026-07-01" -EndDate "2026-07-20" `
  -UserIds compromised@contoso.com -ResultSize 5000

# Search specific operations
Search-UnifiedAuditLog -StartDate "2026-07-01" -EndDate "2026-07-20" `
  -Operations "New-InboxRule","Set-InboxRule","Set-Mailbox","Add-MailboxPermission" `
  -ResultSize 5000

# MailItemsAccessed (E5 only)
Search-UnifiedAuditLog -StartDate "2026-07-01" -EndDate "2026-07-20" `
  -Operations MailItemsAccessed -UserIds compromised@contoso.com -ResultSize 5000

# Export -- AuditData field is JSON, expand it
Search-UnifiedAuditLog -StartDate "2026-07-01" -EndDate "2026-07-20" `
  -UserIds compromised@contoso.com -ResultSize 5000 |
  Select-Object CreationDate, UserIds, Operations,
    @{N='AuditData';E={$_.AuditData | ConvertFrom-Json | ConvertTo-Json -Depth 10}} |
  Export-Csv -Path .\ual_export.csv -NoTypeInformation

Key UAL operations

| Operation | Significance | | --- | --- | | MailItemsAccessed | Bind = single item read, Sync = bulk download. Bulk sync is the BEC exfiltration indicator. | | New-InboxRule / Set-InboxRule | Rules hiding replies or forwarding. Check for keyword targets: "invoice", "payment", "security". | | Set-Mailbox | ForwardingSMTPAddress or ForwardingAddress changed -- silent external forwarding. | | Add-MailboxPermission | FullAccess or SendAs delegation -- persistence. | | Consent to application | OAuth grant. AuditData contains the permissions. | | Add service principal credentials | New secret/certificate on an app registration. | | HardDelete / SoftDelete | Evidence destruction -- attacker deleting sent items. |

The UAL caps at 50,000 results per query. Narrow the date range if you hit it.

Entra ID Sign-In Analysis

Query sign-in logs and look for:

• **Impossible travel** -- distant locations within an impossible timeframe
• **Anonymous IPs** -- Tor exits, VPN services, known anonymizers
• **Legacy auth** -- IMAP, POP3, SMTP AUTH bypass MFA unless CA blocks