Unified Audit Log Retention, Licensing and Missing Logs
What Microsoft 365 and Entra ID logs keep, for how long, on which licence, and what a BEC investigation cannot see when a source is missing or disabled.
Posts tagged: #sign-in-logs
Entra ID Sign-in Logs Analysis: Risky Sign-ins and Travel
How to analyze Entra ID sign-in logs in a BEC case: key fields, error codes, impossible travel and its false positives, spray, MFA fatigue, legacy auth.
AiTM Phishing Detection: Finding Token Replay in Entra ID
How AiTM phishing steals Microsoft 365 sessions despite MFA, and how to detect the token replay in Entra ID sign-in logs and the Unified Audit Log.
How to Analyze the Unified Audit Log in Your Browser
Walkthrough: load a Purview audit export and Entra sign-in logs into M365 Forensics, then read the verdict, findings, timeline and remediation list.
How to Export the Unified Audit Log and Entra Sign-in Logs
Step-by-step export of the Purview Unified Audit Log and Entra ID sign-in and audit logs for a BEC case: roles, row limits, PowerShell paging, pitfalls.