https://www.m365forensics.com/en/blog Latest from Blog en Mon, 28 Sep 2026 22:07:45 GMT https://www.m365forensics.com/en/blog/microsoft-365-audit-log-retention-and-gaps https://www.m365forensics.com/en/blog/microsoft-365-audit-log-retention-and-gaps What Microsoft 365 and Entra ID logs keep, for how long, on which licence, and what a BEC investigation cannot see when a source is missing or disabled. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.m365forensics.com/en/blog/fictional-bec-incident-walkthrough https://www.m365forensics.com/en/blog/fictional-bec-incident-walkthrough A fictional AiTM business email compromise rebuilt from its Microsoft 365 logs: spray, token replay, inbox rules, forwarding, OAuth consent, fake invoice. Florian Amette Thu, 24 Sep 2026 00:00:00 GMT https://www.m365forensics.com/en/blog/bec-first-hour-response-microsoft-365 https://www.m365forensics.com/en/blog/bec-first-hour-response-microsoft-365 The first hour after a Microsoft 365 business email compromise: stop the money, keep the logs, revoke sessions and remove persistence, in the right order. Florian Amette Tue, 22 Sep 2026 00:00:00 GMT https://www.m365forensics.com/en/blog/mailitemsaccessed-what-it-proves https://www.m365forensics.com/en/blog/mailitemsaccessed-what-it-proves Reading MailItemsAccessed records in a BEC case: Sync vs Bind, InternetMessageId, throttling, licensing, and telling the attacker's reads from the user's. Florian Amette Sat, 19 Sep 2026 00:00:00 GMT https://www.m365forensics.com/en/blog/illicit-consent-grant-investigation https://www.m365forensics.com/en/blog/illicit-consent-grant-investigation How to spot an illicit OAuth consent grant in the Unified Audit Log and Entra audit logs, which scopes matter, and how to remove the app's access. Florian Amette Thu, 17 Sep 2026 00:00:00 GMT https://www.m365forensics.com/en/blog/entra-id-sign-in-logs-analysis https://www.m365forensics.com/en/blog/entra-id-sign-in-logs-analysis How to analyze Entra ID sign-in logs in a BEC case: key fields, error codes, impossible travel and its false positives, spray, MFA fatigue, legacy auth. Florian Amette Tue, 15 Sep 2026 00:00:00 GMT https://www.m365forensics.com/en/blog/aitm-phishing-token-replay-detection https://www.m365forensics.com/en/blog/aitm-phishing-token-replay-detection How AiTM phishing steals Microsoft 365 sessions despite MFA, and how to detect the token replay in Entra ID sign-in logs and the Unified Audit Log. Florian Amette Sat, 12 Sep 2026 00:00:00 GMT https://www.m365forensics.com/en/blog/malicious-inbox-rules-and-forwarding https://www.m365forensics.com/en/blog/malicious-inbox-rules-and-forwarding How attackers use inbox rules and forwarding in a BEC, how to find them in the Unified Audit Log and with Get-InboxRule, and how to tell them from real ones. Florian Amette Thu, 10 Sep 2026 00:00:00 GMT https://www.m365forensics.com/en/blog/unified-audit-log-investigation https://www.m365forensics.com/en/blog/unified-audit-log-investigation Reading the Unified Audit Log in a BEC case: the AuditData JSON, the operations to filter on, and how SessionId and UniqueTokenId link actions to sign-ins. Florian Amette Tue, 08 Sep 2026 00:00:00 GMT https://www.m365forensics.com/en/blog/analyze-microsoft-365-audit-logs-in-your-browser https://www.m365forensics.com/en/blog/analyze-microsoft-365-audit-logs-in-your-browser Walkthrough: load a Purview audit export and Entra sign-in logs into M365 Forensics, then read the verdict, findings, timeline and remediation list. Florian Amette Sat, 05 Sep 2026 00:00:00 GMT https://www.m365forensics.com/en/blog/export-unified-audit-log-and-entra-sign-in-logs https://www.m365forensics.com/en/blog/export-unified-audit-log-and-entra-sign-in-logs Step-by-step export of the Purview Unified Audit Log and Entra ID sign-in and audit logs for a BEC case: roles, row limits, PowerShell paging, pitfalls. Florian Amette Thu, 03 Sep 2026 00:00:00 GMT https://www.m365forensics.com/en/blog/microsoft-365-bec-investigation-guide https://www.m365forensics.com/en/blog/microsoft-365-bec-investigation-guide How to investigate business email compromise in Microsoft 365: which logs to pull, what to look for in each, how to tie actions to the attacker's session. Florian Amette Tue, 01 Sep 2026 00:00:00 GMT