Microsoft 365 and Exchange Online forensics

Most email incidents start small: a client asks why your banking details changed, or a user notices replies they never sent. Resetting a password ends the immediate access but answers none of the questions that matter afterwards. Who got in, how, for how long, what did they read or send, and does anyone need to be notified?

A forensic investigation of the tenant answers them with evidence you can show a bank, insurer, regulator or court.

• Business email compromise, where an attacker uses a real mailbox to send fake invoices or change payment instructions
• Mailbox takeover after phishing, password reuse or an MFA prompt the user approved by mistake
• Wire-fraud attempts, successful or not, where you need to show your bank and insurer how it happened
• Insider and departing-employee concerns, such as mail forwarded to a personal account or bulk access to files before a resignation
• Privacy complaints or breach assessments where you must establish whether personal information was accessed

Microsoft 365 records a great deal, but across several portals with different retention rules and licensing. We collect from each source, normalize timestamps to UTC and read them together.

1. 01

   Preserve

   We place eDiscovery holds on affected mailboxes and OneDrive accounts and export audit and sign-in data before it ages out. If containment has not happened, we coordinate it so evidence is recorded before rules or apps are removed.

2. 02

   Collect

   Using tightly scoped administrative access, we export audit records, Entra ID logs, mailbox configuration, transport rules, app consents and message trace results, with hashes and a collection log.

3. 03

   Analyze

   We identify the first malicious sign-in, how access was gained, every IP address and session tied to the attacker, and every change made inside the tenant. MailItemsAccessed and file activity records tell us what the attacker could have read.

4. 04

   Build the timeline

   Events from every source are merged into a single UTC timeline, from initial access through containment, so each finding can be traced to the underlying record.

5. 05

   Report

   You receive a written forensic report with findings, the timeline, the scope of data exposure and our methodology, written for executives, counsel and insurers.

6. 06

   Remediate

   We close the gaps the attacker used: remove persistence, revoke sessions and tokens, tighten app consent and forwarding controls, and review MFA and Conditional Access, either directly or as a checklist for your IT provider.

The core deliverable is a forensic report that stands on its own: plain-English findings first, then the evidence behind each conclusion, with record identifiers another examiner could check.

You can see the structure in our sample incident response report. Where a matter is heading toward litigation, the report can be prepared at the direction of counsel, and expert-witness support is available.

• Executive summary: cause, duration and impact
• Timeline of attacker activity in UTC
• Mailboxes, messages and files accessed, and the basis for each conclusion
• Fraudulent messages sent and their recipients
• Persistence found and removed
• Facts counsel needs for a breach assessment
• Prioritized remediation and chain-of-custody record

Microsoft 365 logs do not last forever. Microsoft's documentation lists 180 days as the default retention for Audit (Standard) records, with one year for Exchange, SharePoint, OneDrive and Entra records generated by users with E5 or equivalent audit licensing. Entra ID sign-in and audit logs are kept for far less: seven days without Entra ID P1 or P2 and 30 days with Entra ID P1 or P2, unless they are exported to storage. Upgrading a licence after the fact does not bring back records that have already expired.

Evidence can also be lost through good intentions. Deleting a forwarding rule, removing an app or wiping a laptop before anything is recorded can erase the facts that show how the attacker operated. Call before you clean up, or at least export and screenshot what you can first.

These steps contain the account without wiping out what the investigation needs. Write down the time of each one.

1. 01

   If money moved, call the bank

   Ask the business fraud line to attempt a recall and to contact the receiving bank.

2. 02

   Block sign-in and revoke sessions

   A password reset alone does not end a session the attacker already holds. Revoke sessions in Microsoft Entra, then reset the password and review MFA methods.

3. 03

   Record, then remove, rules and forwarding

   Export or screenshot inbox rules, forwarding and delegates before disabling them. Their names and creation times are evidence.

4. 04

   Do not delete the user or the mailbox

   Deleting the account or the suspicious messages destroys evidence that the audit log alone cannot replace.

5. 05

   Move coordination off the affected email

   Use phones or a separate account. An attacker in the tenant may be reading the response.

Because the evidence sits in the Microsoft 365 tenant, collection is usually remote and can begin once access is granted, wherever the organization is in Ontario or the rest of Canada. ITRS has done this work since 2018 and also manages Microsoft 365 tenants day to day, so recommendations come from people who configure Conditional Access and audit retention, not only read about them. For context on how exposed GTA domains are to impersonation, see our Q4 2026 GTA email security study: only 20.7% of 482 mail-enabled GTA business domains enforced DMARC in October 2026.