investigating-m365-entra

Investigating M365 and Entra ID

M365/Entra investigations differ from on-premises DFIR -- there are no disk images, no memory dumps, and no event logs you can collect yourself. Everything comes from API queries against Microsoft's log stores, several of which require E5 licensing or advanced audit to retain what you need. Knowing which logs exist, which ones are missing, and how long they last is half the investigation.

When to Use

• Business email compromise (BEC) -- unauthorized mailbox access, forwarding, or impersonation
• Entra ID account compromise -- suspicious sign-ins, token replay, credential stuffing
• Suspicious OAuth consent grants -- third-party apps with excessive permissions
• Mailbox rule manipulation -- inbox rules hiding attacker communications or forwarding mail
• Azure AD sign-in anomalies -- impossible travel, legacy auth, anonymizer networks
• Conditional Access or MFA tampering -- policy changes, MFA fatigue attacks

When NOT to Use

• Broader incident response methodology -- use responding-to-incidents
• Offensive testing of Entra ID -- use attacking-entra-id
• An Azure resource/subscription compromise -- use investigating-azure-incidents
• An AWS compromise -- use investigating-aws-incidents
• Other cloud infrastructure (GCP, offensive testing) -- use exploiting-cloud-platforms
• Building detection rules from findings -- use engineering-detections

Log Landscape and Retention

Before you query anything, establish what you have and how far back it goes. Missing logs are a finding, not a reason to skip the question.