Microsoft 365 / Entra ID - DFIR Guidebook

Microsoft 365 / Entra ID #

Log sources

M365 / Entra timestamps 101: UAL CreationTime is ISO-8601 UTC set at the moment the Microsoft 365 backend processed the event. Ingestion lag into Purview Search is officially up to 30 min for most workloads and up to 24 h for a few outliers - budget for this when scoping a tight timeline. Entra ID sign-in logs use createdDateTime (UTC) stamped by the STS; the authenticationProcessingDetails array has per-leg sub-timestamps. Entra's four sign-in streams (Interactive, Non-interactive, Service principal, Managed identity) each have their own retention and must be pulled separately.

Source	Access	Retention default	Notes	Parsers / tools
Unified Audit Log (UAL)	Purview Audit (Standard/Premium), `Search-UnifiedAuditLog` PS, Office 365 Mgmt API	180d Standard, 1yr Premium (configurable to 10yr add-on)	The master log. Normalized schema with `Operation`, `UserId`, `ClientIP`, `UserAgent`, `Workload`. ts: `CreationTime` ISO-8601 UTC (seconds). Ingestion lag up to 30 min, occasionally 24 h - rerun searches after a day to catch late arrivals. Record-level `AuditData.Timestamp` may differ slightly from `CreationTime` (workload clock vs. UAL ingest).	Hawk (community, Paul Navarro, M365 IR go-to), Microsoft Extractor Suite (Invictus-IR, Joey Rentenaar/Korstiaan Stam), DFIR-O365-RC (ANSSI), MIA (Mandiant Incident Automation), Untitled Goose Tool (CISA), UAL Timeline Creator
MailItemsAccessed	UAL	Audit (Standard); on by default for Office 365 / Microsoft 365 E3 and E5	Records mail access over every protocol (POP, IMAP, MAPI, EWS, ActiveSync, REST). Sync (desktop Outlook only) is logged per folder - treat every item in a synced folder as exposed. Bind (individual message reads) is grouped into one record per 2 minutes, listing each message by `InternetMessageId`. Repeat access to the same item within an hour is de-duplicated. Older guidance described throttling (records marked `IsThrottled`); Microsoft's current documentation doesn't, so check the tenant's records rather than assume it. ts: `CreationTime` (UTC) per record; a bind record covers a 2-minute window, so individual reads inside it aren't separately timed. Separate attacker from user activity with `ClientIPAddress`, `ClientInfoString` and `SessionId`.	Microsoft Extractor Suite `Get-MailItemsAccessed`, Hawk, `Search-UnifiedAuditLog -Operations MailItemsAccessed`
MessageBind / SendAs / SendOnBehalf	UAL (Exchange)	Same	Delegate / shared mbx access patterns. ts: UAL `CreationTime`; also mirrored in Exchange MailboxAuditLog with its own `LastAccessed` property per item.	Search-MailboxAuditLog, Hawk
Entra ID sign-in logs	Entra portal / Graph API `auditLogs/signIns`	30d Free, 7d Premium Interactive separate from Non-interactive and Service Principal and Managed Identity sign-ins, four separate streams	Export to Log Analytics/Sentinel for durable storage. Non-interactive is where token replay lives. ts: `createdDateTime` ISO-8601 UTC with ms precision; `authenticationDetails[].authenticationStepDateTime` for each MFA/CA step. Retention: 7 d without Entra P1, 30 d with P1/P2, but `Interactive` is kept separately from the other three streams in Graph (easy to miss non-interactive refresh events).	Microsoft Graph PowerShell (`Get-MgAuditLogSignIn`), Microsoft Extractor Suite, AzureHound, ROADtools, Entra portal, Sentinel KQL
Entra ID audit logs	Graph `auditLogs/directoryAudits`	30d	Role assignments, app consent, device registration. ts: `activityDateTime` UTC; `initiatedBy.user` or `initiatedBy.app` tells you which clock domain set it (user action vs. app token).	Get-MgAuditLogDirectoryAudit, Microsoft Extractor Suite, 365Inspect
Risky users / risky sign-ins	Entra ID Protection (P2)	90d (configurable)	ML signals: anomalous travel, leaked creds, suspicious IP. ts: `riskLastUpdatedDateTime`, `detectedDateTime`, `lastUpdatedDateTime` - all UTC. Detection ts can lag the sign-in by hours as the risk engine aggregates.	Get-MgRiskyUser, Get-MgRiskDetection, Entra portal
Defender for Cloud Apps / Office 365	security.microsoft.com	Varies	Alerts and advanced hunting KQL across identity+endpoint+email+cloudapp tables. ts: KQL `Timestamp` column UTC with ms. MDE device events add `DeviceId`+`Timestamp`; advanced hunting typically has 30 d of history online.	Advanced Hunting KQL (`IdentityLogonEvents`, `EmailEvents`, `CloudAppEvents`, `DeviceProcessEvents`), MDE Live Response
Message Trace	EAC	Detailed 10d, basic 90d, HMT 10d	For specific message flow questions. ts: `Received`/`EndDate` UTC. Historical Message Trace (HMT) is run async and produces a report with each row's own received time.	Get-MessageTrace, Get-HistoricalSearch, EAC console
Purview eDiscovery (Premium)	purview.microsoft.com	Hold + export	Preservation + export for CoC. Use for mailbox/OneDrive/Teams snapshots. ts: each exported item carries its native workload ts (mail `Received`, Teams `composeTime`, SharePoint `Modified`). Preservation hold is applied at `HoldCreated` ts - anything after is preserved.	Purview console, eDiscovery PS cmdlets (`New-ComplianceSearch`, `New-ComplianceSearchAction`), Advanced eDiscovery API

Operations to search for in UAL

UserLoggedIn / UserLoginFailed - Azure AD STS; join to Entra sign-ins for full context
MailItemsAccessed, Send, SendAs, Create, HardDelete, SoftDelete, MoveToDeletedItems
New-InboxRule, Set-InboxRule - autoforward / autodelete rules are the AiTM hallmark (filter messages w/ "password", "invoice", "wire", "DocuSign")
Set-Mailbox w/ ForwardingSmtpAddress / DeliverToMailboxAndForward
Add-MailboxPermission, Add-RecipientPermission, Add-MailboxFolderPermission
New-TransportRule - tenant-wide mail routing (powerful; rare; big red flag)
Consent to application, Add service principal, Add owner to application, Update application - Certificates and secrets management - APT29 playbook
Add member to role - any Entra privileged role (Global Admin, Privileged Role Admin, Application Admin, Cloud App Admin, Exchange Admin)
Register device, Add device - Entra device join; sets up PRT for the attacker
Disable Strong Authentication, Update StsRefreshTokenValidFrom - MFA tamper & token revoke abuse

AiTM / token theft - the dominant 2024-26 pattern

Phishing kits Evilginx, Tycoon 2FA, EvilProxy, Mamba 2FA, Storm-1575 operate as reverse proxies that capture the session cookie post-MFA. Attacker replays the cookie from their IP.

Detect

Entra sign-in: same SessionId seen from victim IP then attacker IP within minutes
Impossible travel on non-interactive sign-ins (token refresh)
User-agent anomaly - kit UA strings; eM Client, Thunderbird, Mozilla/5.0 on OWA when user is Outlook native
UAL New-InboxRule within 60min of a suspicious sign-in
Entra ID Protection "Anomalous Token" risk detection

Respond

Revoke-AzureADUserAllRefreshToken / Revoke-MgUserSignInSession - invalidates all refresh tokens
Force password reset - note: this alone does not kill existing session tokens
Audit for OAuth app consents added during window
Audit inbox rules; disable autoforwarding at tenant level (Set-RemoteDomain -AutoForwardEnabled $false)

Entra ID attack techniques to hunt for

Illicit consent grants / OAuth app phishing - malicious multi-tenant app requests Mail.ReadWrite, offline_access, full_access_as_app. Review Consent to application events; least-privileged tenant should require admin consent.
Service Principal cert add - attacker with Application Admin / Cloud App Admin adds a cert to an existing SP → logs in as the app with its granted perms → silent persistence. (APT29 / Midnight Blizzard M.O., the Microsoft corporate breach Jan 2024 and HPE 2023.)
Entra Connect sync account abuse - the on-prem sync account has broad directory rights.
Golden SAML - AD FS token-signing cert theft; adversary mints SAML assertions.
Device join for PRT - attacker joins a device, obtains Primary Refresh Token, bypasses conditional access that relies on compliant device.
Legacy auth (basic auth over IMAP/POP/SMTP, EWS basic), mostly disabled since 2022 but legacy tenants / app passwords linger. Confirm via Set-TransportConfig and Entra "Block legacy auth" conditional access.
MFA fatigue / bombing - repeated push prompts until user approves. Number matching (default now) mitigates.
Pass-the-cookie from infostealer → OWA/Teams session without MFA re-prompt.

Teams & SharePoint / OneDrive

Teams: audit for TeamsAdminAction, external federation changes, guest invites; messages via Purview compliance search.
SharePoint/ODfB: FileAccessed, FileDownloaded, FileSyncDownloadedFull, FileUploaded, SharingSet (anonymous links are a classic exfil vector).
Watch for AnonymousLinkCreated, SecureLinkCreated, SharingInvitationCreated for external users.