investigating-m365-entra

name	investigating-m365-entra
description	Investigate a Microsoft 365 and Entra ID compromise where the only evidence is cloud logs — the Unified Audit Log, Entra sign-in and audit logs, OAuth app-consent grants, and mailbox inbox/forwarding rules — to reconstruct business email compromise, token and session theft, and consent abuse. Use for a suspected M365/Entra account takeover with no host or memory to image. Preserve the Unified Audit Log first; its retention is finite and the attacker's rules keep working while you look.
verified	2026-08-08T00:00:00.000Z

Investigating M365 / Entra Incidents

A Microsoft 365 compromise usually leaves no host to image — the crime scene is entirely in the cloud logs. An attacker who phishes a session token or tricks a user into consenting a malicious OAuth app does not need malware: they read mail, set a hidden forwarding rule, and pivot to invoice fraud, and every step is a record in the Unified Audit Log (UAL), the Entra sign-in logs, or the mailbox configuration. The investigator reconstructs the takeover from those records. The urgency is twofold: UAL retention is finite, and any forwarding or inbox rule the attacker set is still exfiltrating mail while you investigate.

Confirm the tenant is in scope per AGENTS.md. Enable/confirm UAL access early and export the relevant window before retention lapses. This is read-only investigation; disabling the account, revoking sessions, or removing a malicious app is the operator's containment call.

When to Use

• A suspected M365/Entra account takeover or business email compromise (BEC)
• No disk or memory to image — only cloud logs (UAL, sign-ins, OAuth grants)
• Hunting hidden inbox/forwarding rules and delegate/permission changes
• Investigating malicious OAuth app consent as a persistence and exfil path