Microsoft 365 logs: the evidence the firm loses
After an email incident, reconstruction depends on logs with limited retention, which must be preserved beforehand.
When a client disputes a diverted bank transfer or a document sent to the wrong address, the question is always the same: what happened in the mailbox, and when. In Microsoft 365 the answer lies not in the email but in the logs: the unified audit log, accessible from Microsoft Purview, and the Entra ID sign-in and audit logs. To preserve them, the owner must agree with the technician which logs to collect, for how long and who can consult them.
Which Microsoft 365 logs are needed to reconstruct an incident
- Entra ID sign-in logs: date, IP, application, second-factor result, session identifier. They show from where, and with which device, the mailbox was opened.
- Unified audit log: creation of mail rules (New-InboxRule, Set-InboxRule), permission changes, forwarding, deletions, activity on OneDrive and SharePoint.
- Mailbox auditing: the MailItemsAccessed operation shows which messages were read, but its availability depends on the licence.
Three limits to know beforehand
Retention is limited in time and depends on the licence; Microsoft has changed these periods several times, so they must be checked on your own tenant and not taken from an article. Entra ID sign-in logs remain available for less time than the audit log. And a compromised administrative account can change the logging settings: whoever controls the tenant also controls the evidence.
Checks for your IT specialist before an incident
First check: in Exchange Online PowerShell, Get-AdminAuditLogConfig must return UnifiedAuditLogIngestionEnabled set to True. If it is not, it must be enabled with Set-AdminAuditLogConfig: logging starts from that moment, not retroactively.
Then a periodic export to an archive outside the tenant, with read-only access and credentials different from the Microsoft 365 administration credentials. This can be done with Search-UnifiedAuditLog in a scheduled script or, where the licence allows, with Entra ID diagnostic settings sending to a storage account. The frequency should be set according to the actual retention of each log, with a margin for any export errors. A monthly collection can leave gaps uncovered.
Chain of custody
Each export should come with a note: who made it, when, with which query and time range, on which account. The file is closed with a SHA-256 hash recorded separately, and times are kept in UTC, as Microsoft returns them. That way, if the reconstruction comes before a forensic expert or a judge, the evidence has a documented provenance rather than an export improvised the day after.
One of the cases these logs can help clarify is session theft on the firm’s mailboxes. On how to acquire and preserve evidence, see the note on digital evidence with legal value; when the reconstruction is intended for litigation, Digital Forensics comes into play.
