Investigating Microsoft 365 Activities

What it is

After a compromise, the key question is what the attacker actually did: which mail they read, which files they touched, which settings they changed. Microsoft 365 records this activity. This page covers three sources that a SOC analyst uses: Microsoft Purview Audit, content search in Microsoft Purview eDiscovery, and the Microsoft Graph activity logs.

How it works

Microsoft Purview Audit

Audit records user and admin activity across Exchange, SharePoint, OneDrive, Teams, Entra ID and more. You search it in the Microsoft Purview portal with a date range, users and activities, and the results list the time, the user, the operation and the item.

Useful operations when investigating a compromised account:

For deletions, the operations separate the steps: MoveToDeletedItems is a move to the Deleted Items folder, SoftDelete is removal from Deleted Items into Recoverable Items, and HardDelete is a purge from Recoverable Items. Move records a move to another folder.

Because advanced hunting keeps only 30 days of data, and Audit keeps data for at least 180 days, an incident that began 75 days ago, such as SharePoint activity, can be investigated with an Audit search even though a hunting query on CloudAppEvents returns nothing for the early weeks. Extending a query's time range cannot return data that no longer exists.

Audit logs can also be exported or searched through PowerShell and the Office 365 Management Activity API, to feed a SIEM.

Content search in Microsoft Purview eDiscovery

A content search finds content in mailboxes, SharePoint sites, OneDrive accounts and Teams, using keywords and conditions such as date, sender and subject. For threat response, its power is that it works on the content itself, with no 30 day limit like Threat Explorer.

• Build a query, such as the subject and sender of a phishing message.
• Choose the locations: specific mailboxes or all mailboxes.
• Run the search and preview the results to check them.
• Export the results for evidence, or purge the items.

Purge options are soft delete, which moves items to Recoverable Items, and hard delete, which removes them permanently. A message delivered 45 days ago to 120 mailboxes that Threat Explorer no longer shows can be found and purged with a content search. Take care to test the query on a few mailboxes first, since a broad query can purge legitimate mail. A hold can be placed on mailboxes to preserve content for a legal case.

Roles matter. The user needs eDiscovery permissions, for example the eDiscovery Manager role, to search, and a further permission, Search And Purge, to purge.

Microsoft Graph activity logs

Microsoft Graph activity logs record the HTTP requests made to the Microsoft Graph API in your tenant: which application or user called which endpoint, with the response code and details. They help find an attacker, or a malicious application, using Graph to read mail, list users or change settings. For example, a script making high volume calls to enumerate users stands out here.

Key points:

• They are not on by default. You enable them with a diagnostic setting in Microsoft Entra, choosing the MicrosoftGraphActivityLogs category and a destination such as a Log Analytics workspace.
• Once in Log Analytics or Sentinel, you query them with KQL, for example to count requests per application.
• They need Microsoft Entra ID P1 or P2 to export.
• Combine them with the sign in logs for the application, and the audit logs, to see the whole story of an application based attack.

Choosing the source

A worked scenario

A compromised account sent phishing mail to staff. The analyst searches the Audit log for the user's operations over the past 90 days and finds a new inbox rule, a long run of MailItemsAccessed events and a SearchQueryInitiatedExchange record with the keyword "invoice". She also sees SoftDelete and HardDelete events showing the attacker cleaned up. Threat Explorer no longer shows the first phishing mail, so she runs a content search with the sender and subject, previews the results and purges them. Separately, Graph activity logs, sent to Sentinel by a diagnostic setting, reveal a malicious app making high volume calls to list users.