Microsoft 365 Account Compromise Investigation: An Evidence-First Checklist

A suspected Microsoft 365 account compromise can quickly turn into a fragmented investigation.

Sign-in activity is stored in Microsoft Entra ID. Mailbox events appear in Exchange Online and Microsoft Purview Audit. Email delivery information lives in message trace. Files may have been accessed through SharePoint or OneDrive, while additional alerts may be available in Microsoft Defender.

The challenge is not simply finding logs. It is preserving the right evidence, placing events in the correct order, and determining what the attacker actually accessed or changed.

This evidence-first checklist provides a practical starting point for Microsoft 365 account compromise and Business Email Compromise investigations.

Do not delay urgent containment

When active compromise is suspected, containment should begin immediately. Depending on the situation, this may include:

• Disabling the affected account
• Resetting the password
• Revoking active sessions
• Reviewing registered authentication methods
• Removing unauthorized administrative access
• Reviewing suspicious application permissions
• Blocking confirmed malicious activity

Evidence preservation should happen in parallel with containment, not instead of containment. When possible, assign one responder to secure the account and another to collect and preserve the available evidence.

Before expanding the investigation, record:

• The affected user and mailbox
• The time the incident was reported
• The suspected start and end times
• The user's normal location and working pattern
• Known suspicious IP addresses, messages, or applications
• Actions already performed by administrators
• All relevant times normalized to UTC

1. Collect Microsoft Entra sign-in evidence

Start with Microsoft Entra sign-in logs for the affected account. Review both interactive and non-interactive sign-ins. Interactive events involve direct user authentication, while non-interactive activity may occur when applications or operating-system components use existing tokens in the background.

For each relevant event, preserve:

• Date and time
• IP address
• Geographic location
• Application and resource
• Device and operating system
• Browser or client application
• Authentication requirement
• MFA result
• Conditional Access result
• Risk status
• Correlation and request identifiers

Do not assume that a successful MFA result proves the user initiated the session. An attacker may be using a stolen session, an existing refresh token, a newly registered authentication method, or a malicious application consent.

Look for patterns rather than isolated events:

• The first successful sign-in from a new location
• Repeated failures followed by a successful sign-in
• Unfamiliar applications
• Legacy or unexpected client protocols
• Sign-ins continuing after a password reset
• Activity outside the user's normal working hours
• Multiple simultaneous sessions from unrelated locations

2. Review identity and configuration changes

Next, examine Microsoft Entra audit activity around the suspected compromise period. Important changes may include:

• Authentication methods added or removed
• New MFA devices registered
• Password resets
• Group membership changes
• Administrative role assignments
• Application registrations
• OAuth consent grants
• Conditional Access changes
• New devices or credentials
• Security information updates

A suspicious sign-in indicates that unauthorized access may have occurred. A configuration change may show how the attacker attempted to maintain access, bypass controls, or increase privileges.

3. Examine Exchange Online activity

For Business Email Compromise investigations, Exchange Online evidence is often as important as identity logs.

Inbox rules and forwarding

Attackers frequently create rules that hide replies, move messages into less visible folders, delete security notifications, or forward email externally. Review:

• Inbox rules
• Mailbox forwarding settings
• Transport rules
• Delegated mailbox permissions
• Send As permissions
• Send on Behalf permissions
• Recently added external recipients
• Rules that move or delete messages containing financial terms

Do not review only the rules visible in Outlook. Administrative tools and audit data may reveal additional mailbox configuration changes.

Sent, deleted, and accessed messages

Review the affected mailbox for:

• Unexpected messages in Sent Items
• Deleted messages
• Messages moved to unusual folders
• Financial and payment conversations
• Password-reset messages
• Messages containing sensitive attachments
• Unfamiliar signatures or reply addresses
• Changes in tone, wording, or recipient patterns

Mailbox audit information may help determine whether messages were opened, sent, moved, created, or deleted during the suspected compromise period.

Message trace

Use Exchange Online message trace to establish what happened to suspicious messages. Preserve:

• Sender
• Recipient
• Subject
• Timestamp
• Delivery status
• Message ID
• Processing actions
• Relevant policy results

Message trace can help determine whether a message was received, rejected, deferred, redirected, or successfully delivered.

4. Search Microsoft Purview Audit

Microsoft Purview Audit provides a broader record of user and administrator activity across Microsoft 365. Begin with a sufficiently broad investigation window. Avoid narrowing the activity types too early because the initial goal is to understand the overall sequence of events.

Useful evidence may include:

• Mailbox access
• Message activity
• Inbox-rule changes
• File access and downloads
• Sharing-link creation
• Permission changes
• Administrative actions
• Application and consent activity
• SharePoint and OneDrive events

Use UTC timestamps consistently. Export the original results before filtering or transforming them, and keep original evidence files separate from analyst working copies.

5. Review SharePoint and OneDrive activity

A compromised Microsoft 365 identity may provide access beyond email. Review whether the user account:

• Opened or downloaded sensitive files
• Created public or anonymous sharing links
• Shared documents with external users
• Changed file or folder permissions
• Accessed unusual SharePoint sites
• Downloaded a larger-than-normal volume of content
• Accessed files unrelated to the user's normal responsibilities

The mailbox may have been only the attacker's entry point. The full investigation should cover every Microsoft 365 service accessible through the affected identity.

6. Review Microsoft Defender signals

Microsoft Defender may provide additional alerts and investigation context. Review available signals related to:

• Risky sign-ins
• Impossible travel
• Unfamiliar sign-in properties
• Suspicious inbox manipulation
• Malicious email activity
• OAuth application abuse
• Endpoint activity associated with the user
• Identity-related alerts

Defender alerts are important evidence, but an alert should not be treated as the complete investigation. Confirm significant findings by correlating them with the underlying identity, mailbox, audit, and file activity.

7. Preserve evidence before it expires

Evidence collection should begin quickly because retention periods vary between Microsoft services, subscriptions, and licensing levels. Organizations that require longer investigation windows should consider exporting relevant activity or routing logs to approved long-term storage, Microsoft Sentinel, Azure Monitor, or another security platform.

At a minimum:

• Preserve original exports
• Record the export date and time
• Document the administrator who performed the export
• Keep original files read-only
• Store analyst working copies separately
• Record any filters or transformations applied during analysis

Evidence that is not preserved may no longer be available when the organization needs to investigate, report, or defend its conclusions.

8. Build one investigation timeline

Raw exports from different Microsoft services should be converted into a single timeline. For each event, record:

• UTC timestamp
• User or workload identity
• Source service
• IP address
• Application
• Action performed
• Target resource
• Related message, file, or artifact
• Assessment: confirmed, suspicious, or benign
• Analyst notes

The timeline should help answer the central investigation questions: how the attacker authenticated, when unauthorized access began, which Microsoft 365 services were accessed, what data was viewed, downloaded, shared, or modified, whether persistence mechanisms were created, whether messages were sent, read, moved, forwarded, or deleted, whether administrative privileges or authentication methods were changed, when containment was completed, and whether suspicious activity continued afterwards.

From evidence to a defensible conclusion

A useful incident report should clearly distinguish between confirmed facts, analyst conclusions, and unanswered questions. The final report should contain:

• Executive summary
• Confirmed incident scope
• Investigation timeline
• Indicators of compromise
• Affected accounts and resources
• Evidence reviewed
• Containment and remediation actions
• Evidence gaps
• Recommended security improvements

A password reset may secure an account, but it does not explain what happened before the reset. A defensible Microsoft 365 investigation requires evidence from multiple services, careful timeline correlation, and a clear record of what is known and what remains uncertain.

Supporting Microsoft 365 investigations

Cleverina helps organizations improve Microsoft 365 incident readiness, identity governance, evidence collection, and investigation workflows.

Cleverina Incident Assistant is being developed to help analysts organize Microsoft 365 evidence into structured findings, indicators, timelines, analyst notes, and report-ready outputs while keeping final conclusions under human control.