01Purpose and scope
To collect, before retention removes it, the provider-side record of who signed in to an account, from where, and what they changed in the mailbox, in a form whose completeness can be shown.
A Microsoft 365 tenant with Exchange Online and Microsoft Entra ID; business email compromise, invoice fraud and unexplained forwarding. Content export (eDiscovery) is covered by SOP-07.
02Prerequisites
- Written authority naming the tenant, the accounts in scope and the period.
- A named examiner account with a read-only audit role (for example Audit Reader in Microsoft Purview and Reports Reader in Entra), so the examiner's own actions are attributable.
03Steps
Check retention before anything else
Write down the licence and what it keeps. Entra ID sign-in and audit logs are kept 7 days on the Free tier and 30 days with P1 or P2; Purview Audit (Standard) keeps unified audit records 180 days for records created since 17 October 2023. If the incident window is near those limits, acquire sign-ins first.
RecordRetention table with licence, log type, days and the oldest date still available
Export Entra sign-ins for the accounts in scope
Interactive and non-interactive sign-ins, with IP address, location, client app, user agent, conditional access result and the session or correlation ID. Export as JSON or CSV with all columns; non-interactive sign-ins are where token reuse shows.
RecordExport file name, query, row count, time and SHA-256
Search the unified audit log in time slices
Query by user and by operation (UserLoggedIn, New-InboxRule, Set-InboxRule, UpdateInboxRules, Set-Mailbox, Add-MailboxPermission, Consent to application). Split the period into slices small enough that no query reaches the result limit, and log each query with its start, end and count.
RecordQuery log: slice, filter, returned count
Capture the mailbox configuration as it is now
Inbox rules (including hidden ones), forwarding addresses (ForwardingSmtpAddress, ForwardingAddress, DeliverToMailboxAndForward), delegates and folder permissions, and OAuth applications with consent. The audit log shows when a rule was created; only the configuration shows whether it is still there.
RecordConfiguration export with time of capture
Keep the raw AuditData
Every unified audit record carries a JSON AuditData column with the client IP, session ID and rule parameters. Keep the export unparsed; parse a copy. Never open the original in a spreadsheet and save it.
Hash and register each export
SHA-256 on receipt, one custody line per file, as in SOP-03. A re-run of the same query later will not return the same rows if retention has moved; the first export is the evidence.
RecordCustody line per export with hash
Normalise times and record the gaps
All three sources are in UTC, but a portal view may show the examiner's local time. State in the record which logs were not enabled, which periods were beyond retention and which queries hit a limit.
RecordGap statement
04Records produced
- Retention table and gap statement
- Query log with counts
- Exports with SHA-256 and custody lines
05Pitfalls
- Resetting the user's password and revoking sessions before acquisition is right for containment but erases nothing; deleting the inbox rule does erase the current configuration, so capture it first.
- Sign-in location is derived from the IP address; a VPN or a cloud host shows the provider's location, not the person's.
- An empty audit search is not proof of no activity until you have confirmed that auditing was on for that period.