Preparing a Microsoft 365 Tenant for DFIR

First Rule of Cloud Engagement

Never log into a compromised tenant using the client’s existing administrator credentials. The client’s internal accounts may be backdoored, actively monitored by the adversary, or subject to session hijacking. Every forensic action must originate from a freshly provisioned, dedicated, cloud-only analyst identity.

Concept

When a Computer Security Incident Response Team (CSIRT) or forensic investigator begins an engagement in a Microsoft 365 environment, the immediate priority is to establish a secure, traceable, and uncompromised investigative bridgehead.

Tenant onboarding is not an administrative afterthought; it is a critical forensic procedure. It dictates whether subsequent findings will withstand legal scrutiny, ensures the investigation does not alert the threat actor, and prevents analysts from being locked out mid-triage by automated security policies.

+---------------------------------------------------------------------------------------------------+
|                            TENANT PREPARATION & FORENSIC ONBOARDING PIPELINE                      |
|                                                                                                   |
|   +-------------------------------------------------------------------------------------------+   |
|   |                         PHASE 1: PROVISIONING CLOUD-ONLY IDENTITIES                       |   |
|   |   Dedicated UPN: sec-dfir-analyst01@client.onmicrosoft.com (Never On-Premises Synced)     |   |
|   |   Issuance via Temporary Access Pass (TAP) | Zero Pre-Shared Static Passwords               |   |
|   +---------------------------------------------+---------------------------------------------+   |
|                                                 |                                                 |
|                                                 v                                                 |
|   +-------------------------------------------------------------------------------------------+   |
|   |                         PHASE 2: AUTHENTICATION HARDENING & MFA                           |   |
|   |   Mandatory Hardware Token (FIDO2 WebAuthn) or Microsoft Authenticator Number Matching   |   |
|   |   Strict Exclusion from Legacy MFA Policies | Out-of-Band Registration Pipeline           |   |
|   +---------------------------------------------+---------------------------------------------+   |
|                                                 |                                                 |
|                                                 v                                                 |
|   +-------------------------------------------------------------------------------------------+   |
|   |                         PHASE 3: CONDITIONAL ACCESS AUDIT & ALIGNMENT                     |   |
|   |   Audit Named Locations | Whitelist CSIRT Public CIDR / Dedicated Ingress Ranges          |   |
|   |   Validate Client Application Filters | Prevent Accidental Lockout or Blocking Alerts     |   |
|   +---------------------------------------------+---------------------------------------------+   |
|                                                 |                                                 |
|                                                 v                                                 |
|   +-------------------------------------------------------------------------------------------+   |
|   |                         PHASE 4: LEAST-PRIVILEGE ROLE ATTRIBUTION                         |   |
|   |   Entra ID: Global Reader + Security Reader | Purview: View-Only Audit Logs               |   |
|   |   Exchange: View-Only Recipients | Time-Bound Elevation via Entra PIM                     |   |
|   +-------------------------------------------------------------------------------------------+   |
+---------------------------------------------------------------------------------------------------+

---

Why It Matters in DFIR

Ad-hoc, hurried tenant access during an active crisis consistently causes forensic disasters:

1. Chain of Custody Invalidation: If three external analysts and two internal administrators share a generic admin_temp@company.com account, attribution in the Unified Audit Log is irrevocably destroyed. You cannot prove in court whether a sensitive mailbox search was executed by the CSIRT or the threat actor.
2. Adversary Alerting: If an investigator logs into an account already compromised by a threat actor, the actor’s session management tooling will immediately detect concurrent logins from unexpected IP ranges, triggering panic exfiltration or ransomware execution.
3. Analyst Lockout: Aggressive Conditional Access policies (e.g., blocking non-corporate devices or geofencing outside of France) may block the CSIRT’s forensic workstations or trigger automated password resets that paralyze the investigation.
4. Tainted Break-Glass Accounts: Utilizing the organization’s break-glass emergency accounts for everyday forensic work leaves the enterprise defenseless if a true identity lockout occurs during remediation.

---

How It Works

1. Cloud-Only Identity Requirement

Forensic accounts must always be cloud-only (created directly in Entra ID, residing in the tenant.onmicrosoft.com domain).

• Why: Synchronized on-premises Active Directory accounts (OnPremisesSyncEnabled: True) rely on on-premises domain controllers and Entra Connect (Fiche 39: Entra Connect). If the on-premises AD is compromised (e.g., via DCSync or Golden Ticket), the attacker can reset the investigator’s cloud password from the local domain.

2. Secure Onboarding via Temporary Access Pass (TAP)

Instead of an internal IT admin creating an account with a temporary password sent over unencrypted email or Teams:

1. The client administrator generates a single-use Temporary Access Pass (TAP) valid for 1 hour.
2. The analyst signs in via myprofile.microsoft.com using the TAP over an encrypted, out-of-band communication channel.
3. The analyst registers their own FIDO2 security key (YubiKey) or Microsoft Authenticator app.
4. No static password ever traverses unencrypted channels.

3. Conditional Access Alignment

The client must review active Conditional Access policies before the CSIRT connects:

• Add the CSIRT’s static egress IP blocks to Entra ID Named Locations (trusted: true).
• Ensure the forensic account group is excluded from policies requiring Compliant Devices (since the analyst’s dedicated forensic workstation is not managed by the client’s Intune tenant).

4. Role Segregation: Directory vs Workload

A common error is requesting only Global Administrator. While powerful, Global Administrator creates liability (a keystroke could delete production data) and still lacks granular compliance permissions in Microsoft Purview (Fiche 05: Global Reader). The proper forensic bundle requires:

• Entra ID: Global Reader + Security Reader.
• Microsoft Purview: Compliance Administrator or role group containing View-Only Audit Logs.
• Exchange Online: View-Only Recipients or Compliance Management.

---

What Is Possible

Proper tenant preparation ensures:

• Flawless Non-Repudiation: Every single search, export, and inspection performed by the CSIRT is logged with the analyst’s unique UPN in the tenant’s audit trail.
• Unrestricted Forensic Read Access: Analysts can query logs, configurations, mail flows, and policies across all workloads without risking operational disruption.
• Safe Out-of-Band Operations: The investigation proceeds completely invisible to any adversary monitoring the compromised users’ inboxes or Teams chats.

---

What Is Not Possible

• No Stealth from Tenant-Wide Audit Logs: Forensic accounts cannot perform queries without generating audit events. The creation of the forensic account and its logins will be recorded in Entra Audit Logs. If the threat actor possesses Global Administrator privileges, they can observe the creation of sec-dfir-analyst01.
• No Bypassing Missing Historical Logs: Prepping the tenant today preserves all future and currently retained telemetry, but cannot recover expired logs (Fiche 18: Audit Retention).

---

Prerequisites & Necessary Conditions

Before the client administrator creates accounts:

1. Established Out-of-Band Communication: Secure Signal/Proton/telephone channel established with the client incident commander.
2. Static Egress IPs: The CSIRT must provide their static forensic proxy/VPN IP addresses.
3. Signed NDA / Authorization Letter: Clear legal authorization to access and export tenant telemetry.

---

Artifacts and Evidence Sources

Tenant preparation actions generate distinct footprints in the tenant’s audit logs:

Action	Log Stream	Activity Name	Forensic Significance
Forensic Account Creation	Entra Directory Audit	Add user	Proves when the investigation officially commenced.
TAP Issuance	Entra Directory Audit	Generate temporary access pass	Verifies secure onboarding without password sharing.
FIDO2 / MFA Registration	Entra Directory Audit	User registered security info	Confirms phishing-resistant MFA registration.
Role Assignment	Entra Directory Audit	Add member to role	Documents the exact read privileges granted to the CSIRT.
Named Location Update	Entra Directory Audit	Add named location	Records the CSIRT’s static IP range inclusion.

---

Investigation Methodology

1. Provide Onboarding Template to Client Administrator: Send the client the exact PowerShell script to create cloud-only accounts and assign least-privilege forensic roles:

   # 1. Create Cloud-Only Forensic Account
   $PasswordProfile = New-Object -TypeName Microsoft.Open.AzureAD.Model.PasswordProfile
   $PasswordProfile.ForceChangePasswordNextLogin = $true
   $PasswordProfile.Password = "Generate-Strong-OneTime-Secret!"
   
   $User = New-MgUser -DisplayName "CSIRT Forensic Analyst 01" `
     -UserPrincipalName "sec-dfir-analyst01@company.onmicrosoft.com" `
     -AccountEnabled $true -MailNickname "sec-dfir-analyst01" `
     -PasswordProfile $PasswordProfile
   
   # 2. Assign Global Reader Directory Role
   $Role = Get-MgDirectoryRole | Where-Object {$_.DisplayName -eq "Global Reader"}
   New-MgDirectoryRoleMember -DirectoryRoleId $Role.Id -DirectoryObjectId $User.Id

2. Verify Purview Role Group Assignment: Ensure the account is added to the View-Only Organization Management or Audit Reader role group in Purview:

   Connect-IPPSSession
   Add-RoleGroupMember -Identity "View-Only Organization Management" -Member "sec-dfir-analyst01@company.onmicrosoft.com"

3. Validate Ingress & Conditional Access: Test interactive login from the forensic workstation. Confirm that no Conditional Access policy blocks the connection.

4. Verify Logging Telemetry Baseline: Confirm that the Unified Audit Log is globally enabled:

   Connect-ExchangeOnline
   Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled

---

Practical Example / Case Walkthrough

Scenario: The Hijacked Investigation

During an active BEC crisis, an enterprise IT director created a generic user audit@company.com and texted the password to the external consultant. Unknown to IT, the attacker had compromised the IT director’s personal mobile device and was monitoring their communications.

The Failure:

1. The attacker logged into audit@company.com 10 minutes prior to the consultant, utilizing the shared password.
2. The attacker reviewed the Purview audit queries executed by the consultant, identifying exactly which mailboxes were under investigation.
3. The attacker deleted compromised inbox rules and sent extortion messages to the CEO before the consultant could preserve the evidence.

The Remediation: The CSIRT immediately terminated the generic account, instituted the Cloud-Only Named Account Protocol with FIDO2 WebAuthn authentication, and conducted all triage through an isolated, untracked channel.

---

Common Pitfalls and Traps

Pitfall	Reality	Consequence
Using Synced AD Accounts	An attacker controlling the on-prem domain controller can compromise the cloud analyst account.	The investigator’s credentials are hijacked via on-premises DCSync.
Relying on SMS for Analyst MFA	SMS is vulnerable to SIM-swapping and AiTM phishing proxies.	The analyst’s own session is exposed to cloud interception.
Omitting Purview Audit Roles	Global Reader cannot search the UAL without explicit Purview permissions.	The analyst cannot extract audit records during the critical first hours.

---

Key Takeaways

1. Cloud-only accounts are non-negotiable: Never use synchronized Active Directory identities for cloud investigations.
2. Enforce phishing-resistant MFA: FIDO2 keys or Authenticator number matching must be mandatory for all forensic identities.
3. Traceability protects the CSIRT: Named accounts ensure that every analytical search is distinguished from threat actor actions.
4. Bundle directory and workload roles: Combine Global Reader with Purview View-Only Audit Logs and Exchange permissions.

---

Feature State in 2026

Recent Changes

• Temporary Access Pass (TAP) Integration: Native zero-password onboarding is now standard across all Entra ID enterprise tenants.
• Privileged Access for Groups: Forensic permissions can be assigned to an Entra security group with PIM elevation, automatically provisioning role bundles across Entra ID and Purview simultaneously.

Deprecated Features

• Legacy App Passwords for MFA are permanently disabled across all tenants.

---

References

• Microsoft Learn: Plan a Microsoft Entra Privileged Identity Management Deployment
• Microsoft Learn: Configure Temporary Access Pass in Microsoft Entra ID
• Microsoft Learn: Permissions in the Microsoft Purview Compliance Portal
• Hermes Codex: Global Reader for DFIR: Capabilities and Pitfalls