Microsoft 365 & Azure investigations
A mailbox sends phishing, a supplier's bank details suddenly change, or sign-ins come from the other side of the world. I find out what the attacker accessed, cut their access and close the door behind them.
When to call
- Sign-ins from unusual countries, or unexpected MFA prompts
- A mailbox sends phishing to your contacts
- Emails disappear, or strange inbox rules and forwarding appear
- A payment went to new bank details (business email compromise)
- An unknown application was granted access to your tenant
How I work
- 01
Triage
Confirm the compromise: sign-in context, risk detections, and what the user saw.
- 02
Preserve
Export Entra ID sign-in and audit logs and the Unified Audit Log before anything changes or expires.
- 03
Contain
Revoke sessions and tokens, reset credentials, remove attacker MFA methods, malicious inbox rules, forwarding and OAuth consents.
- 04
Scope
Which emails and files were read, which messages were sent, and which other accounts show the same traces.
- 05
Harden and report
Close the entry point (MFA, Conditional Access, alerting) and deliver a clear report of what happened.
What you get
- A timeline of the attacker's activity in your tenant
- The list of compromised accounts and the data accessed
- Containment actions carried out and documented
- Hardening recommendations for Microsoft 365 and Entra ID
- A report you can share with your management, your insurer or the authorities
See an excerpt of a sample incident response reportPDF, 3 pages, in English. Fictitious, anonymised scenario. Request the full 30-page report
Why Cyber Horizon
- Hands-on experience investigating Microsoft 365 and Azure incidents
- Daily use of Entra ID, Purview audit, Defender XDR and Microsoft Sentinel
- GIAC Security Expert (GSE #433)
- You work directly with me, from the first call to the report
Frequently asked questions
How did they get in despite MFA?
Often through an adversary-in-the-middle phishing page that steals the session after MFA, an infostealer on a device, or an MFA prompt the user approved. The investigation tells you which one, and how to stop it.
How long are Microsoft 365 logs kept?
Entra ID sign-in and audit logs: 7 days without a P1/P2 licence, 30 days with one. The Unified Audit Log is kept longer. That's why exporting early matters.
Do we need to notify anyone?
If personal data was accessed, you may have to notify the Data Protection Authority within 72 hours, and sometimes the people concerned. Check with your legal adviser; the investigation gives you the facts to decide.
Can deleted emails be recovered?
Often yes, for a limited time, depending on your retention settings. Don't purge anything while the investigation is running.
What is the difference with incident response?
This is incident response focused on Microsoft 365 and Azure. If the attacker also reached your endpoints or servers, the investigation extends to them: see incident response.