Microsoft 365 DFIR Access Matrix

In cloud forensic investigations across Microsoft 365 and Microsoft Entra ID, incident responders frequently encounter permission friction: responders request role assignments only to find that critical log streams remain hidden, API queries return HTTP 403 Forbidden, or search exports fail.

A successful investigation requires establishing early, unambiguous, and least-privilege forensic permissions. This guide provides an operational matrix mapping every forensic data source across Microsoft 365 to its minimal role, recommended operational role, licensing requirements, native retention limits, and primary extraction vectors.

---

Concept

The Microsoft 365 forensic plane spans across independent role-based access control (RBAC) domains:

1. Entra ID Directory Roles: Govern the identity plane, tenant settings, authentication logs, and directory object definitions (see Fiche 02 — Microsoft Entra ID: The Identity Plane).
2. Microsoft Purview RBAC: Controls compliance investigations, Unified Audit Log (UAL) search, and eDiscovery data exports (see Fiche 13 — Unified Audit Log Deep Dive and Fiche 14 — Audit Log vs UAL vs Entra Audit Log).
3. Workload-Specific RBAC (Exchange, SharePoint, Teams): Governs tenant workload configurations, direct mailbox inspection, and diagnostic tracing (see Fiche 33 — Exchange Online Investigation and Fiche 34 — SharePoint Online Investigation).
4. Microsoft Defender XDR Unified RBAC: Controls raw telemetry, alert triage, and transport tracing across identity, cloud apps, email, and endpoints (see Fiche 15 — Exchange Message Trace Forensics).

Granting Global Reader satisfies only the Entra ID and portal viewing layer; it leaves forensic blindspots across Purview, raw mailbox access, and Advanced Hunting raw telemetry (as detailed in Fiche 05 — Global Reader for DFIR: Scope and Blindspots).

---

The Master DFIR Access Matrix

The following table synthesizes the operational requirements for incident response across Microsoft 365:

Forensic Data Source	Workload / Domain	Minimal Role (Least Privilege)	Recommended DFIR Role	License Required	Native Retention	Primary Extraction Vectors	Why Global Reader Alone Fails
User Sign-in Logs (Interactive)	Entra ID	Reports Reader	Security Reader	Free (7d) / P1/P2 (30d)	7 to 30 days	Graph API (/auditLogs/signIns), PowerShell Microsoft.Graph	GR can view in portal and Graph, but cannot correlate with Defender XDR signals.
Non-Interactive & Service Principal Sign-ins	Entra ID	Reports Reader	Security Reader	Entra ID P1 / P2	30 days	Graph API (/auditLogs/signIns), PowerShell	GR can view, but non-interactive sign-ins are unavailable under Entra Free.
Directory Audit Logs (User/Group/App modifications)	Entra ID	Reports Reader	Security Reader	Free (7d) / P1/P2 (30d)	7 to 30 days	Graph API (/auditLogs/directoryAudits), PowerShell	GR provides full read access to directory audits.
Identity Protection Risk Events	Entra ID Protection	Security Reader	Security Reader	Entra ID P2 / E5	30 to 90 days	Graph API (/identityProtection/riskyUsers, riskDetections)	Reports Reader cannot view risk remediation status; GR works, but P2 license is required.
Unified Audit Log (UAL) (General operations)	Purview Compliance	Purview View-Only Audit Logs	Purview Audit Reader + Security Reader	M365 Business Basic / E3 / E5	180 days	Search-UnifiedAuditLog, Graph Purview Audit API	GR CANNOT search UAL in Purview portal or run Search-UnifiedAuditLog.
Premium Audit Events (MailItemsAccessed, Send)	Purview Compliance	Purview View-Only Audit Logs	Purview Audit Reader	Purview Audit (Premium) / E5	1 year (up to 10 yrs with add-on)	Search-UnifiedAuditLog, PowerShell	GR has zero access. Unlicensed users generate no Premium audit telemetry.
Exchange Message Trace (Metadata < 10 days)	Exchange Online	Exchange View-Only Recipients	Exchange View-Only Configuration	Exchange Online Plan 1/2	10 days (realtime)	Get-MessageTrace, Exchange Admin Center (EAC)	GR can access EAC, but Message Trace reports require specific Exchange RBAC roles.
Exchange Message Trace (Historical > 10 to 90 days)	Exchange Online	Exchange Data Loss Prevention	Exchange Compliance Management	Exchange Online Plan 1/2	90 days	Start-HistoricalSearch, Get-HistoricalSearch	Historical trace generates asynchronous CSV exports; GR lacks export initiation permissions.
Mailbox Message Content (Email bodies, attachments)	Exchange Online	Purview eDiscovery Manager	Purview eDiscovery Manager (or Mailbox Delegation)	Purview eDiscovery Standard / Premium	Retained until purged (or held by Lit Hold)	Purview Content Search, eDiscovery Export Tool, Graph Mail API	GR CANNOT read message bodies or download email items under any circumstances.
Mailbox Folder Statistics & Rules	Exchange Online	Exchange View-Only Recipients	Exchange View-Only Configuration	Exchange Online Plan 1/2	Current State	Get-InboxRule, Get-MailboxFolderStatistics	Requires Exchange Online PowerShell session; GR does not map natively without Exchange view roles.
SharePoint / OneDrive File Audit & Access	SharePoint / Purview	Purview Audit Reader	Purview Audit Reader + SharePoint Admin	SharePoint Online Plan 1/2	180 days (UAL)	Search-UnifiedAuditLog, Graph Drive API	GR cannot search file download events in UAL without Purview Audit Reader.
SharePoint / OneDrive File Contents	SharePoint Online	Site Collection Administrator	eDiscovery Manager or Site Admin	SharePoint Online Plan 1/2	Lifecycle dependent	SharePoint REST API, eDiscovery Content Export	GR CANNOT download non-public files from OneDrive personal accounts or private sites.
Teams Meeting Transcripts & Private Chats	Microsoft Teams / Purview	Purview eDiscovery Manager	Purview eDiscovery Manager	Teams Essentials / E3 / E5	Retained until purged	Purview Content Search, Graph Protected APIs (/chats/getAllMessages)	GR CANNOT read private chat contents or retrieve meeting recordings.
Defender XDR Advanced Hunting (Raw 30-day telemetry)	Microsoft Defender XDR	Defender Security Reader	Defender Security Reader	Defender for Endpoint / Office / Identity / E5	30 days	Defender Portal, Advanced Hunting API (/api/advancedhunting/run)	GR alone cannot access Defender Advanced Hunting API unless Security Reader is also mapped.
OAuth Consent Grants & Service Principal Secrets	Entra ID	Security Reader	Security Reader	Entra ID Free / P1 / P2	Current State	Graph API (/oauth2PermissionGrants, /servicePrincipals)	GR can read grants, but cannot inspect service principal credentials or audit logs without Graph roles.

---

Why Global Reader Alone Fails for DFIR

A common failure mode during incident response triage occurs when client administrators provide an external responder with only Global Reader. Responders quickly discover the following roadblocks:

1. The Purview Audit Wall

The Unified Audit Log (UAL) is governed by Purview RBAC, not Entra ID RBAC. When a Global Reader opens compliance.microsoft.com or connects via PowerShell:

# Attempting to search UAL as Global Reader:
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-3) -EndDate (Get-Date)

Output:

Write-ErrorMessage : The term 'Search-UnifiedAuditLog' is not recognized as the name of a cmdlet,
function, script file, or operable program.

Without the Audit Reader or View-Only Audit Logs role assigned in the Microsoft Purview Compliance portal, the Exchange/Compliance management session does not expose the cmdlet to the responder’s runspace.

2. The Content Inspection Wall (eDiscovery)

Global Reader explicitly excludes data-plane inspection:

• Cannot open or download an email flagged as malicious phishing from a user mailbox.
• Cannot download an exfiltrated document located in a user’s OneDrive personal site collection.
• Cannot export private Teams chat transcripts exchanged between an adversary and internal victims. Acquiring actual evidence contents requires eDiscovery Manager role in Purview or explicit application-level read permissions (Mail.Read, Files.Read.All) with an approved investigation scope.

3. Defender Advanced Hunting Telemetry

Accessing the 30-day raw telemetry tables in Microsoft Defender XDR (CloudAppEvents, IdentityLogonEvents, EmailEvents, DeviceInfo) requires:

• Security Reader role in Entra ID or Defender Unified RBAC Security Operations (Read).
• Global Reader can view alert cards in the Defender portal, but cannot execute KQL queries against the raw event stream through the Defender API or portal query engine if Defender Unified RBAC has migrated permissions.

---

Minimal Forensic Role Profiles

To avoid over-privilege (such as requesting Global Administrator) while ensuring total visibility, responders should request one of three standardized forensic role sets:

graph TD
    subgraph "Forensic Role Profiles"
        A[Profile 1: Triage & Audit] -->|Roles| A1[Entra: Security Reader<br/>Purview: Audit Reader<br/>Exchange: View-Only Configuration]
        A -->|Capability| A2[Sign-ins, UAL, PIM, Message Trace, Defender Alerts]

        B[Profile 2: Deep Extraction & Content] -->|Roles| B1[Profile 1 +<br/>Purview: eDiscovery Manager<br/>Graph App: Mail.Read, Files.Read.All]
        B -->|Capability| B2[Email bodies, OneDrive files, Teams chats, Forensic preservation]

        C[Profile 3: Live Remediation & Containment] -->|Roles| C1[Entra: Privileged Role Admin or Temp GA via PIM<br/>Purview: Compliance Administrator]
        C -->|Capability| C2[Revoke refresh tokens, apply Litigation Hold, block compromised apps]
    end

Profile 1: Non-Destructive Triage and Forensic Audit (Read-Only)

• Entra ID Role: Security Reader (includes Reports Reader capabilities, enables sign-in inspection, risk detections, and identity logs).
• Purview Role: Audit Reader (grants permission to search and export the Unified Audit Log).
• Exchange Online Role: View-Only Configuration + View-Only Recipients (enables Get-InboxRule, message trace queries, and transport configuration review).
• Defender XDR Role: Security Reader (enables Advanced Hunting raw KQL queries).

Profile 2: Forensic Evidence Acquisition (Content Search & Deep Extraction)

Includes all permissions from Profile 1, plus:

• Purview Role: eDiscovery Manager (assigned within Purview Compliance portal). Allows searching email bodies, OneDrive file contents, SharePoint document libraries, and Teams communications.
• Service Principal (Automated Extraction): Entra App Registration with certificate authentication, consented with:
  • AuditLog.Read.All
  • Directory.Read.All
  • SecurityIncident.Read.All
  • SecurityEvents.Read.All
  • (Optional for content retrieval): Mail.Read, Files.Read.All (restricted via RBAC or ApplicationAccessPolicy).

Profile 3: Incident Containment and Remediation (Active Response)

Requires write permissions. Should always be elevated via Privileged Identity Management (PIM) with ticketing justification and multi-factor approval:

• Entra ID Role: User Administrator (to revoke tokens, reset passwords, and disable compromised accounts).
• Exchange Online Role: Organization Management (to remove malicious forwarding rules, transport rules, or quarantine emails).
• Purview Role: Compliance Administrator (to place urgent Litigation Holds and preserve mailbox data).

---

Investigation Methodology: Verifying Investigator Privileges

Before initiating evidence collection, verify your operational access in PowerShell to ensure no silent failures or missing cmdlets occur during triage.

PowerShell Verification Script

# ==============================================================================
# Hermes Codex - M365 DFIR Access Verification Script
# Validates Entra ID, Purview, Exchange Online, and Defender access
# ==============================================================================

Write-Host "[*] Verifying Microsoft 365 Forensic Role Assignments..." -ForegroundColor Cyan

# 1. Verify Microsoft Graph & Entra ID Read Access
Import-Module Microsoft.Graph.Authentication, Microsoft.Graph.Reports -ErrorAction Stop

$graphContext = Get-MgContext
if ($null -eq $graphContext) {
    Write-Warning "[-] Not connected to Microsoft Graph. Run Connect-MgGraph first."
} else {
    Write-Host "[+] Graph Connected as: $($graphContext.Account) (Tenant: $($graphContext.TenantId))" -ForegroundColor Green
    try {
        $testSignIn = Get-MgAuditLogSignIn -Top 1 -ErrorAction Stop
        Write-Host "[+] Entra Sign-In Logs Access: SUCCESS" -ForegroundColor Green
    } catch {
        Write-Error "[-] Entra Sign-In Logs Access: FAILED ($($_.Exception.Message))"
    }
}

# 2. Verify Exchange Online & Message Trace Access
Import-Module ExchangeOnlineManagement -ErrorAction Stop

try {
    $session = Get-ConnectionInformation | Where-Object { $_.ConnectionStatus -eq "Connected" }
    if ($session) {
        Write-Host "[+] Exchange Online Connected." -ForegroundColor Green
        $testTrace = Get-MessageTrace -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) -PageSize 1 -ErrorAction Stop
        Write-Host "[+] Exchange Message Trace Access: SUCCESS" -ForegroundColor Green
    } else {
        Write-Warning "[-] Exchange Online session not connected. Run Connect-ExchangeOnline."
    }
} catch {
    Write-Error "[-] Exchange Message Trace Access: FAILED ($($_.Exception.Message))"
}

# 3. Verify Purview Unified Audit Log Access
try {
    $testUAL = Search-UnifiedAuditLog -StartDate (Get-Date).AddHours(-2) -EndDate (Get-Date) -ResultSize 1 -ErrorAction Stop
    Write-Host "[+] Purview Unified Audit Log Access: SUCCESS" -ForegroundColor Green
} catch {
    Write-Error "[-] Purview UAL Access: FAILED ($($_.Exception.Message))"
    Write-Warning "    -> Missing Purview 'Audit Reader' or 'View-Only Audit Logs' role!"
}

Graph REST Token Scope Verification

# Decode JWT Access Token to inspect scp (delegated) or roles (app-only) claims
# Tool: jq and base64

ACCESS_TOKEN="eyJ0eXAiOiJKV1QiLC..."

# Extract and decode the payload
echo "$ACCESS_TOKEN" | cut -d'.' -f2 | base64 -d 2>/dev/null | jq '{
    app_displayname: .app_displayname,
    appid: .appid,
    roles: .roles,
    scp: .scp,
    tid: .tid,
    upn: .upn,
    exp: (.exp | todate)
}'

---

The Transversal Doctrine: Access vs Observation vs Proof

A critical principle of Hermes Codex DFIR doctrine is distinguishing between what permissions allow and what log telemetry actually proves:

+-------------------------------------------------------------------------------+
|                      THE 7 LEVELS OF FORENSIC CERTAINTY                       |
|                                                                               |
|  1. Possible     -> Workload architecture supports the event.                 |
|  2. Configured   -> Audit logging was enabled and policies were active.       |
|  3. Authorized   -> Account had the RBAC roles / permissions to perform it.   |
|  4. Accessible   -> Network / Conditional Access permitted reachability.       |
|  5. Utilized     -> Account initiated an action on the resource.              |
|  6. Observed     -> Log record exists in UAL, Sign-ins, or Message Trace.     |
|  7. Proven       -> Immutable, correlated, verified forensic certainty.       |
+-------------------------------------------------------------------------------+

Forensic Distinctions in the Access Matrix

1. Authorized != Utilized: If a compromised account held Exchange Administrator, that proves the adversary was authorized to create transport rules or export mailboxes. It does not prove they created a rule unless a corresponding New-TransportRule record is observed in the Unified Audit Log.
2. Configured != Observed: Mailbox audit logging may be enabled at the tenant level, but if the specific target user was unlicensed for Purview Audit (Premium), high-value operations like MailItemsAccessed will not be observed. The investigator must not conclude “no emails were read”; the truthful finding is “telemetry was unavailable due to licensing configuration”.
3. Observed != Proven: A single sign-in record with ResultType = 0 (Success) observed in Entra ID sign-in logs shows an authentication event. However, proving an interactive human adversary session occurred requires correlating the sign-in with subsequent user actions (e.g., UAL events matching the same client IP, User-Agent, and session token ID).

---

Common Pitfalls and Traps

Trap	Technical Root Cause	Investigative Impact	Corrective Action
Requesting Global Admin for Forensics	Over-privileged assignment violates client security policies and triggers emergency escalation.	Delays investigation start by days while awaiting CAB approvals.	Request standard Profile 1 (Security Reader + Purview Audit Reader).
Silent Cmdlet Disappearance	Connecting to Exchange Online via PowerShell with only Entra roles excludes Purview compliance cmdlets.	Search-UnifiedAuditLog returns cmdlet not recognized.	Explicitly assign Audit Reader in Purview Compliance Portal (compliance.microsoft.com).
Assuming 30-Day Retention on Free Tenants	Entra ID Free tenants only retain sign-in and directory audit logs for 7 days.	Evidence from day 10 is permanently lost if not previously forwarded to Sentinel or Event Hub.	Check tenant license tier immediately via Get-MgSubscribedSku (see Fiche 04).
Confusing Message Trace with Email Content	Message Trace only captures delivery metadata (Sender, Recipient, Subject, Timestamp, Status).	Responders cannot analyze malicious payloads, links, or body text from Message Trace.	Use Purview Content Search or Defender for Office 365 Explorer to acquire raw email samples.
Throttling during Bulk Extraction	Requesting massive log exports via Graph without handling HTTP 429 Too Many Requests.	Script crashes halfway through collection, leaving gaps in timeline.	Implement exponential backoff and inspect the Retry-After HTTP response header.

---

2026 Feature State: Access and Permissions

Recent Changes

• Purview RBAC Modernization: Microsoft completed the separation between Entra ID directory roles and Purview compliance permissions. Directory roles (like Security Reader) no longer grant implicit Purview compliance administrator privileges without explicit mapping.
• Audit Standard Retention at 180 Days: Default retention for standard Unified Audit Log records is 180 days across all enterprise plans (expanded from the legacy 90-day window).
• Defender Unified RBAC Enforcement: Defender XDR now enforces fine-grained unified permissions. Responders accessing the Defender portal require granular assignments (e.g., Security Operations (Read)) or the Entra Security Reader role.

Deprecated Features

• AzureAD and MSOnline PowerShell Modules: Permanently retired. All scripted permission checks and role validations must use Microsoft.Graph.Identity.Governance and Microsoft.Graph.Authentication.
• Basic Authentication: Permanently disabled for all remote PowerShell connections to Exchange and Graph. Modern authentication (MFA or Certificate-Based App Registration) is mandatory.

Current Limitations

• Latency Discrepancies: UAL ingestion latency ranges from 15 minutes up to 24 hours depending on workload load (Exchange is typically 15m; SharePoint/Teams can experience delays).
• Non-Retroactive Premium Telemetry: Enabling Audit Premium or assigning E5 licenses during an incident does not retroactively generate historical MailItemsAccessed or Send events.

---

Key Takeaways

1. Global Reader is insufficient: It lacks Purview UAL search permissions, eDiscovery content inspection, and Exchange deep diagnostics.
2. Standardize on Profile 1 for initial triage: Request Security Reader (Entra ID) + Audit Reader (Purview) + View-Only Configuration (Exchange Online) for comprehensive read-only visibility.
3. Verify licensing before forming conclusions: Understand whether the tenant is Entra Free (7 days) or P1/P2 (30 days), and whether mailboxes have Audit Standard (180 days) or Audit Premium (1 year + MailItemsAccessed).
4. Distinguish metadata from content: Message Trace and Sign-in logs provide transaction metadata; acquiring actual message bodies and file contents requires eDiscovery Manager permissions.
5. Always adhere to the forensic certainty scale: Never confuse what an account was authorized to do with what the evidence proves it executed.

---

References

• Microsoft Purview: Permissions in the Microsoft Purview compliance portal
• Microsoft Entra ID: Built-in role permissions
• Microsoft Graph: Audit log API permissions
• Exchange Online: Feature permissions in Exchange Online
• Microsoft Defender XDR: Unified role-based access control (RBAC)