Skip to content
Hermes Codex

Microsoft 365 DFIR Fundamentals & Architecture

Concept

Section titled “Concept”

In digital forensics and incident response (DFIR), Microsoft 365 is not a single monolith, but an interconnected federation of multi-tenant Software-as-a-Service (SaaS) workloads unified by a centralized identity plane: Microsoft Entra ID (formerly Azure Active Directory).

From a forensic standpoint, an enterprise Microsoft 365 environment consists of five distinct tiers:

  1. The Tenant Container: The global isolation boundary representing the organization, identified by an immutable TenantId (Directory ID GUID) and a primary namespace (e.g., company.onmicrosoft.com).
  2. The Identity Plane (Microsoft Entra ID): Governs users, guest identities, service principals, group memberships, and evaluates every inbound access request via the Conditional Access Engine.
  3. The Workload Plane: Autonomous cloud services with independent data stores and specialized APIs:
    • Exchange Online: Corporate messaging, calendar items, transport rules, mailboxes.
    • SharePoint Online & OneDrive for Business: Document repositories, file sync engines, external sharing links.
    • Microsoft Teams: Ephemeral chat pipelines, channel messages, federation threads, meeting recordings.
  4. The Security & Governance Plane:
    • Microsoft Purview: Central repository for the Unified Audit Log (UAL), retention labels, and eDiscovery.
    • Microsoft Defender XDR: Cross-domain threat correlation (Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps).
  5. The Control Plane & Programmable Fabric: Microsoft Graph API (graph.microsoft.com), the unified REST interface through which both legitimate administrators and malicious automated threat actors query, manipulate, or extract tenant state.
+---------------------------------------------------------------------------------------------------+
|                                     MICROSOFT 365 TENANT CONTAINER                                 |
|                               (Immutable TenantId GUID: e.g., aaaabbbb-...)                        |
|                                                                                                   |
|   +-------------------------------------------------------------------------------------------+   |
|   |                           IDENTITY PLANE (MICROSOFT ENTRA ID)                             |   |
|   |   Directory Schema | User Identities | Guest Accounts | Workload Identities / Service Princ.  |   |
|   |   Authentication Services | OAuth 2.0 / OIDC Tokens | Conditional Access Policy Evaluation|   |
|   +---------------------------------------------+---------------------------------------------+   |
|                                                 | (Tokens / PRT / Scopes)                         |
|                    +----------------------------+----------------------------+                    |
|                    |                                                         |                    |
|                    v                                                         v                    |
|   +----------------------------------+                     +----------------------------------+   |
|   |         MESSAGING FABRIC         |                     |         DATA & FILE FABRIC       |   |
|   |         Exchange Online          |                     |    SharePoint Online / OneDrive  |   |
|   |   Mailboxes | Mail Flow Rules    |                     |   Document Libraries | Sync Engine |   |
|   +-----------------+----------------+                     +-----------------+----------------+   |
|                     |                                                        |                    |
|                     +---------------------------+----------------------------+                    |
|                                                 |                                                 |
|                                                 v                                                 |
|   +-------------------------------------------------------------------------------------------+   |
|   |                           COLLABORATION & REAL-TIME FABRIC (TEAMS)                        |   |
|   |   Group Conversations | 1:1 Chats | Channel Storage (SharePoint) | Personal Share (OneDrive)  |   |
|   +---------------------------------------------+---------------------------------------------+   |
|                                                 |                                                 |
|                                                 v                                                 |
|   +-------------------------------------------------------------------------------------------+   |
|   |                         AUDIT, COMPLIANCE & TELEMETRY FABRIC                              |   |
|   |   Microsoft Purview (Unified Audit Log) | Microsoft Defender XDR Alerts & Advanced Hunting|   |
|   +-------------------------------------------------------------------------------------------+   |
+---------------------------------------------------------------------------------------------------+

Why It Matters in DFIR

Section titled “Why It Matters in DFIR”

When responding to a Microsoft 365 breach—whether a Business Email Compromise (BEC), an Adversary-in-the-Middle (AiTM) session hijacking, or a rogue OAuth enterprise application—investigators commonly face serious investigative traps:

  • Workload Decoupling: Authenticating successfully to Entra ID does not automatically generate entries in the Unified Audit Log (UAL) of Exchange Online until the adversary actually performs an API call or mailbox interaction.
  • Log Fragmentation: Different actions generate traces in completely distinct logging pipelines with differing latencies, formats, and retention clocks.
  • Permission Concealment: Threat actors frequently bypass traditional user accounts by registering malicious applications or injecting credentials into existing service principals, persisting invisibly to standard endpoint EDR agents.
  • The Evidentiary Gap: Determining whether an attacker actually downloaded an executive’s mailbox or merely browsed the folder listing requires correlating Entra token issuances with granular workload audit operations like MailItemsAccessed.

Understanding how the tenant is wired is the single prerequisite to knowing where to look, what questions to ask the client, and how to prove adversary actions without making unfounded assumptions.

How It Works

Section titled “How It Works”

1. Identity Authentication vs Workload Authorization

Section titled “1. Identity Authentication vs Workload Authorization”

Microsoft 365 relies strictly on modern authentication (OAuth 2.0 and OpenID Connect):

  1. Authentication (AuthN): The client (browser, mobile app, desktop Outlook) authenticates against Entra ID (login.microsoftonline.com). If Multi-Factor Authentication (MFA) and Conditional Access policies pass, Entra ID issues a Primary Refresh Token (PRT) or refresh token alongside a short-lived Access Token (typically valid for 60 to 90 minutes) scoped to a specific resource (e.g., https://outlook.office365.com or https://graph.microsoft.com).
  2. Authorization (AuthZ): The client presents the Access Token to the target workload API. The workload validates the token’s cryptographic signature, expiration, and embedded claims/scopes, completely independent of Entra ID.

2. Workload Storage & Architecture

Section titled “2. Workload Storage & Architecture”
  • Exchange Online: Stores email items, metadata, calendar, and contacts in high-availability Exchange Database (EDB) partitions within Microsoft’s cloud infrastructure. Mailbox access is governed by Exchange Role-Based Access Control (RBAC).
  • SharePoint Online & OneDrive: Built on SQL Azure backends and Azure Blob storage. OneDrive for Business is architecturally a personalized SharePoint site collection (/personal/username_domain_com) dedicated to a single user.
  • Microsoft Teams: Teams does not possess its own independent data store. Team channel messages are ingested into Exchange Online mailboxes for compliance indexing; channel files are stored in the underlying SharePoint team site; 1:1 chat files are stored in the sender’s OneDrive.

3. Management & Access APIs

Section titled “3. Management & Access APIs”
  • Microsoft Graph (v1.0 and beta): The single programmatic endpoint for tenant administration, user querying, role assignment, and automated data reading.
  • PowerShell SDKs: The modern Microsoft.Graph module (v2+) and ExchangeOnlineManagement (v3+) interact directly with Graph and Exchange REST endpoints.

What Is Possible

Section titled “What Is Possible”

During an intrusion, an adversary who compromises an identity or application in Microsoft 365 can theoretically:

  • Access Mailboxes: Read historical messages, exfiltrate attachments, send phishing emails internally or externally (Fiche 49: BEC).
  • Establish Hidden Persistence: Create Inbox forwarding rules, Exchange transport rules, or register malicious OAuth apps with delegated/application permissions (Fiche 26: Persistence).
  • Harvest Corporate Files: Recursively sync or download SharePoint document libraries and personal OneDrive folders (Fiche 34: SharePoint and Fiche 35: OneDrive).
  • Manipulate Directory Roles: If administrative privileges are obtained, assign directory roles (e.g., Global Administrator) or bypass PIM controls (Fiche 31: Entra Roles).
  • Pivot to On-Premises: Leverage hybrid identity synchronization servers (Entra Connect) to compromise the on-premises Active Directory (Fiche 43: Hybrid Attack Paths).

What Is Not Possible

Section titled “What Is Not Possible”

A forensic investigator must firmly understand the technical boundaries of the cloud platform:

  • No Physical or Disk Forensics: The analyst cannot obtain raw memory dumps (RAM) of Microsoft host hypervisors, mount virtual hard disks (VHDX), or inspect raw NTFS master file tables (MFT) for cloud SaaS workloads.
  • No Retroactive Log Generation: If a feature or audit level (e.g., Purview Audit Premium, Mailbox Audit) was not enabled prior to the incident, the missing log events are lost forever. Purchasing an E5 license post-incident does not backfill historical logs (Fiche 18: Audit Retention).
  • No Bypassing Tenant Isolation: A compromised tenant cannot directly inspect or tamper with another tenant’s underlying infrastructure unless an explicit cross-tenant synchronization, B2B trust, or external federation was deliberately established.

Prerequisites & Necessary Conditions

Section titled “Prerequisites & Necessary Conditions”

To conduct an authoritative forensic examination of a Microsoft 365 tenant, the DFIR team requires:

  1. Dedicated Forensic Accounts: Named accounts created specifically for the CSIRT with Multi-Factor Authentication enabled (Fiche 04: Preparing Tenant).
  2. Appropriate RBAC Permissions: Entra ID roles (e.g., Global Reader, Security Reader) combined with Purview roles (View-Only Audit Logs, Compliance Administrator) (Fiche 06: Access Matrix).
  3. Audit Readiness: Verification that the Unified Audit Log (UAL) is enabled (Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true).
  4. PowerShell 7.x & Modern Modules: Workstations equipped with Microsoft.Graph and ExchangeOnlineManagement v3.x.

Artifacts and Evidence Sources

Section titled “Artifacts and Evidence Sources”
LayerPrimary Evidence SourceLog Storage LocationQuery InterfaceDefault Retention
AuthenticationEntra ID Sign-in Logs (Interactive, Non-Interactive, Service Principals)Entra ID Monitoring / Azure MonitorEntra Admin Center, Graph API (/auditLogs/signIns)7 days (Free), 30 days (P1/P2)
Directory ChangesEntra ID Audit Logs (User, Group, App, Role modifications)Entra ID MonitoringEntra Admin Center, Graph API (/auditLogs/directoryAudits)7 days (Free), 30 days (P1/P2)
User & Admin ActionsUnified Audit Log (UAL)Microsoft Purview CompliancePurview Portal, PowerShell Search-UnifiedAuditLog180 days (Standard), 1-10 years (Premium)
Mail TransitExchange Message TraceExchange Transport PipelineExchange Admin Center (EAC), PowerShell Get-MessageTrace10 days (Interactive), 90 days (Historical Report)
Mailbox AccessMailbox Audit (MailItemsAccessed, SendAs, SoftDelete)Exchange / Unified Audit LogPurview Audit Search, Exchange Online PowerShellInherits UAL retention
Cloud EndpointDefender for Endpoint & Defender XDR TelemetryMicrosoft Defender Security Centersecurity.microsoft.com, Advanced Hunting (KQL)30 days (standard), 180 days (Advanced Hunting)

Investigation Methodology

Section titled “Investigation Methodology”
flowchart TD
    A[Step 1: Scoping & Tenant Identification] --> B[Step 2: Access Onboarding & Verification]
    B --> C[Step 3: Evidence Preservation & Ingestion]
    C --> D[Step 4: Identity & Authentication Triage]
    D --> E[Step 5: Workload Activity & Persistence Audit]
    E --> F[Step 6: Data Access & Blast Radius Assessment]


    A ---|TenantId, Primary Domain, Subscription Licenses| A
    B ---|Assign Global Reader + Purview Audit Reader| B
    C ---|Export Sign-ins, Directory Audits, UAL, Message Trace| C
    D ---|Analyze Risky Users, Conditional Access, Token Events| D
    E ---|Audit Inbox Rules, Transport Rules, OAuth Consents| E
    F ---|Correlate MailItemsAccessed, FileDownloads, Sharing| F

  1. Identify the Tenant Core Metadata: Obtain the immutable TenantId (GUID) and initial domain (tenant.onmicrosoft.com). Validate the licensing tier (E3 vs E5, Entra Free vs P1/P2) to understand log retention limitations.

  2. Establish Forensic Access: Request dedicated, named investigation accounts with MFA configured. Request the necessary read-only directory and Purview compliance roles (Fiche 05: Global Reader).

  3. Perform Emergency Evidence Preservation: Export raw Entra sign-in and audit logs immediately if the incident occurred close to the 30-day (or 7-day) boundary. Place litigation holds on suspected compromised accounts (Fiche 07: Evidence Preservation).

  4. Triage Identity Activity: Examine Entra sign-in logs to identify initial compromised access vectors (IP, user agent, Conditional Access satisfaction, AiTM indicators).

  5. Examine Workload Operations & Persistence: Query the Unified Audit Log (UAL) for administrative changes, inbox rule modifications, OAuth application permissions, and external sharing events.

  6. Assess Blast Radius & Data Compromise: Measure whether sensitive files were accessed or exfiltrated using granular workload audit records (FileDownloaded, SearchQueryPerformed, MailItemsAccessed).

Practical Example / Case Walkthrough

Section titled “Practical Example / Case Walkthrough”

Scenario: The “Invisible” Account Takeover

Section titled “Scenario: The “Invisible” Account Takeover”

A finance manager’s account was flagged by an external vendor reporting receipt of fraudulent invoice instructions. The corporate IT team examined the user’s workstation with EDR and found no malware, concluding that the cloud account was safe.

Forensic Investigation Execution:

  1. Tenant Identification: Connecting via PowerShell:
    Terminal window
    Connect-MgGraph -Scopes "AuditLog.Read.All", "Directory.Read.All"
    (Get-MgOrganization).Id # Captured TenantId
  2. Sign-In Log Triage: Querying Entra sign-in logs revealed an interactive sign-in from a foreign residential IP (198.51.100.24) where Multi-Factor Authentication was recorded as satisfied. The UserAgent was identical to the user’s browser, but the IP was located in an unexpected geographic region (Fiche 21: AiTM).
  3. UAL Correlation: Querying the Unified Audit Log using Search-UnifiedAuditLog:
    Terminal window
    Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-3) -EndDate (Get-Date) `
      -FreeText "New-InboxRule" -UserIds "finance.manager@enterprise.com"
    Artifact Discovered: An operation New-InboxRule created rule "..." configured to automatically mark all incoming emails containing keywords invoice, wire, and bank as read and move them to the RSS Feeds folder (Fiche 27: Mailbox Rules).
  4. Conclusion: The adversary intercepted the user’s session cookie via an AiTM phishing proxy, established an authenticated cloud session, modified mailbox processing rules, and orchestrated a fraud campaign without executing a single byte of malicious code on the local endpoint.

Common Pitfalls and Traps

Section titled “Common Pitfalls and Traps”
PitfallOperational RealityForensic Consequence
”Global Reader sees everything”Global Reader does not grant access to search the Unified Audit Log or view mailbox data in Purview.The investigator wastes hours unable to extract UAL logs without additional Purview roles.
”User logged in = Data stolen”A successful authentication establishes a session, but does not prove files or emails were accessed.Falsely declaring a massive data breach to regulatory authorities without technical proof.
”We bought E5 yesterday to get 1-year logs”Upgrading licensing is strictly prospective; it does not recover events that fell outside the previous retention window.Assuming historical logs exist when they were permanently expunged by the retention policy.
”The IP address is Microsoft, so it’s benign”Non-interactive sign-ins often reflect backend service communications (e.g., Power Automate or Graph) with Microsoft IP ranges.Misattributing automated background synchronization as attacker infrastructure or vice versa.

Key Takeaways

Section titled “Key Takeaways”
  1. Microsoft 365 is a decoupled ecosystem: Entra ID authenticates, but autonomous workloads (Exchange, SharePoint, Teams) independently authorize and process requests.
  2. The Unified Audit Log (UAL) is the forensic backbone: It normalizes actions across workloads, but relies on prior tenant configuration and license-dependent retention windows.
  3. Modern attacks focus on the cloud identity plane: Attackers increasingly bypass endpoint EDR through AiTM phishing, session cookie theft, and OAuth consent grant persistence.
  4. Adhere strictly to the evidentiary ladder: Never conclude that data was exfiltrated without explicit audit logs documenting read or download operations.

Feature State in 2026

Section titled “Feature State in 2026”

Recent Changes

Section titled “Recent Changes”
  • Unified Audit Log Standard Retention: Unified Audit Log Standard retention is officially established at 180 days across all M365 commercial tenants (previously 90 days prior to late 2023).
  • Microsoft Entra Renaming & Deprecations: The AzureAD and MSOnline PowerShell modules are completely retired; forensic collection must rely exclusively on the Microsoft.Graph SDK (v2+) and modern REST APIs.
  • Audit Logging by Default: Core audit events (including historical high-value events like MailItemsAccessed and SearchQueryPerformed) are progressively made accessible to wider licensing tiers, though full 1-year/10-year retention policies still require Purview Audit Premium add-ons.

Deprecated Features

Section titled “Deprecated Features”
  • Legacy Basic Authentication (POP/IMAP/Basic SMTP) is permanently decommissioned across all exchange tenants worldwide.
  • Legacy Azure AD Graph API (graph.windows.net) is fully deprecated in favor of Microsoft Graph (graph.microsoft.com).

Current Limitations

Section titled “Current Limitations”
  • UAL Ingestion Latency: UAL records are not delivered in real-time. Ingestion delay ranges from 15 minutes up to 24 hours depending on the workload.
  • Throttling on Log Exports: Bulk exports via PowerShell Search-UnifiedAuditLog or Office 365 Management Activity API are strictly throttled (HTTP 429) on large enterprise tenants.

Key Monitoring Points

Section titled “Key Monitoring Points”
  • Monitor the progressive rollout of Token Protection (Proof-of-Possession tokens) which binds tokens to specific client hardware, fundamentally neutralizing session cookie replay attacks (Fiche 25: Token Protection).

References

Section titled “References”