Microsoft 365 Logging Architecture

Forensic investigation in cloud environments fails most frequently not from an absence of data, but from a fundamental misunderstanding of the cloud platform’s logging architecture. Microsoft 365 is not a monolithic application with a centralized event log; it is a distributed federation of independent SaaS workloads (Exchange Online, SharePoint, Teams), compliance services (Purview), threat detection engines (Defender XDR), and an identity control plane (Entra ID).

Each subsystem generates events according to its own internal bus, applies disparate filtering criteria, retains records across conflicting retention schedules, and exposes data through separate, specialized APIs. This guide establishes the definitive architectural map of Microsoft 365 logging for incident responders.

---

Concept

The Microsoft 365 logging architecture is organized into four distinct operational planes:

graph TD
    subgraph "1. Identity Plane (Microsoft Entra ID)"
        ID_SIGNIN[Sign-in Logs<br/>Interactive, Non-Interactive, SP, Managed ID]
        ID_AUDIT[Directory Audit Logs<br/>Users, Groups, Roles, App Consents]
        ID_PROV[Provisioning Logs<br/>SCIM, HR Inbound, Cloud Sync]
        ID_RISK[Identity Protection<br/>Risk Detections & Risky Users]
    end

    subgraph "2. Compliance & Audit Plane (Microsoft Purview)"
        PUR_UAL[Unified Audit Log - UAL<br/>Aggregated Events from 40+ Workloads]
        PUR_EDISC[eDiscovery Search & Export Logs]
        PUR_DLP[Data Loss Prevention Alerts & Events]
    end

    subgraph "3. Workload Diagnostic Plane"
        EXO_TRACE[Exchange Message Trace<br/>Real-time & Historical SMTP Routing]
        EXO_MBX[Exchange Mailbox Audit<br/>Owner, Delegate, Admin Actions]
        SPO_AUDIT[SharePoint / OneDrive Site Audit]
        TEAMS_LOGS[Teams Compliance & Chat Telemetry]
    end

    subgraph "4. Security & Hunting Plane (Microsoft Defender XDR)"
        DEF_HUNT[Advanced Hunting - 30d Raw Tables<br/>CloudAppEvents, IdentityLogonEvents, EmailEvents]
        DEF_INC[Defender Incidents & Alerts API]
    end

    ID_SIGNIN -->|Graph API / Diagnostic Settings| SIEM[Log Analytics / Sentinel / SIEM]
    ID_AUDIT -->|Graph API / Diagnostic Settings| SIEM
    ID_PROV -->|Graph API / Diagnostic Settings| SIEM
    ID_RISK -->|Graph API / Diagnostic Settings| SIEM

    PUR_UAL -->|Management Activity API / Graph Purview| SIEM
    EXO_TRACE -->|PowerShell / EAC Export| SIEM
    DEF_HUNT -->|Advanced Hunting API / Event Hub| SIEM

Each plane serves a distinct investigative objective:

1. The Identity Plane: Captures authentication handshakes, token issuance, conditional access evaluations, and directory mutations (see Fiche 02 — Microsoft Entra ID: The Identity Plane).
2. The Compliance Plane: Consolidates user and administrator operational activity across tenant workloads into the Purview Unified Audit Log (see Fiche 13 — Unified Audit Log Deep Dive).
3. The Workload Diagnostic Plane: Retains native, service-specific transaction telemetry (e.g., SMTP transport hops, mailbox folder synchronization) that is either too granular or too high-volume for Purview (see Fiche 15 — Message Trace Forensics and Fiche 17 — Mailbox Auditing).
4. The Security Plane: Enriches raw telemetry with behavioral ML models, threat intelligence, and cross-workload correlations in Defender XDR.

---

Why It Matters in DFIR

When analyzing a multi-stage cloud intrusion (such as an AiTM phishing attack leading to BEC and data exfiltration), an investigator who inspects only one logging plane will assemble an incomplete or misleading narrative:

• The Entra Blindspot: Entra ID sign-in logs prove an authentication occurred, but reveal nothing about whether the attacker read an email, downloaded a spreadsheet, or created a forwarding rule.
• The UAL Blindspot: The Purview Unified Audit Log captures file downloads and mailbox actions, but does not capture raw network packet traces, transient SMTP delivery failures, or conditional access policy diagnostic failures.
• The Latency Trap: If an attacker accesses a mailbox 10 minutes before the responder begins querying the UAL, the events may not appear yet due to ingestion delays (up to 60 minutes for Exchange, up to 24 hours for Teams). Concluding that “no malicious access occurred” during that window is a critical forensic error.

---

How It Works: Ingestion Pipelines and Latency

Every log stream in Microsoft 365 traverses a specific data ingestion pipeline before becoming queryable:

Log Stream	Source Service	Collection Mechanism	Ingestion Latency	Native Retention	Query / Export Interface
Entra Interactive Sign-ins	Entra STS (Security Token Service)	Direct streaming pipeline	2 to 5 minutes	Free: 7d P1/P2: 30d	Microsoft Graph (/auditLogs/signIns), Log Analytics
Entra Non-Interactive Sign-ins	Entra STS	Batched streaming	5 to 15 minutes	P1/P2: 30d (Free: None)	Microsoft Graph, Log Analytics
Entra Directory Audit Logs	Entra Directory Core Store	Change notifications / queue	2 to 5 minutes	Free: 7d P1/P2: 30d	Microsoft Graph (/auditLogs/directoryAudits)
Purview Unified Audit Log (Exchange)	Exchange Mailbox Assistant	Asynchronous publisher queue	15 to 60 minutes	Standard: 180d Premium: 1yr - 10yr	Search-UnifiedAuditLog, Office 365 Management API
Purview Unified Audit Log (SharePoint/OneDrive)	SharePoint Telemetry Processor	Near-real-time event pipeline	15 to 30 minutes	Standard: 180d Premium: 1yr - 10yr	Search-UnifiedAuditLog, Office 365 Management API
Purview Unified Audit Log (Teams)	Teams Service Bus	Background aggregation queue	2 to 24 hours	Standard: 180d Premium: 1yr - 10yr	Search-UnifiedAuditLog, Office 365 Management API
Exchange Message Trace (Real-time)	Exchange Transport Pipeline	In-memory message tracker	< 1 minute	10 days	Get-MessageTrace, Exchange Admin Center
Exchange Message Trace (Historical)	Exchange BigData store	Asynchronous batch indexer	1 to 4 hours to build	90 days	Start-HistoricalSearch, Get-HistoricalSearch
Defender Advanced Hunting	M365 Defender Event Hub	Streaming telemetry bus	1 to 5 minutes	30 days	Defender Portal (KQL), Advanced Hunting API
Microsoft Graph Activity Logs	Graph Gateway / Front-Door	HTTP Request logging pipeline	5 to 15 minutes	Export dependent (No native store)	Azure Log Analytics (Diagnostic Settings only)

---

What Is Possible vs What Is Not Possible

What Is Possible

• Cross-Workload Correlation: Correlating an IP address observed in Entra ID sign-in logs with subsequent file access events in the UAL and SMTP delivery traces in Exchange.
• Continuous Ingestion to SIEM: Exporting all Entra ID logs and UAL events into Azure Log Analytics, Microsoft Sentinel, Splunk, or Elastic using native Diagnostic Settings and the Management Activity API.
• Historical Reconstruction up to 180 Days: Searching standard user and administrator actions across Exchange, SharePoint, and Entra ID over a 6-month historical window (provided UAL was not disabled).
• Proving Non-Interactive Token Usage: Tracking when an attacker leverages a stolen refresh token to query Microsoft Graph without interactive MFA challenges (see Fiche 09 — Entra Sign-in Logs Analysis).

What Is Not Possible

• Retroactive Telemetry Retrieval on Unlicensed Streams: If a tenant lacked Entra ID P1/P2 licenses, non-interactive sign-ins cannot be recovered retroactively. If users lacked Purview Audit (Premium), MailItemsAccessed events were never recorded.
• Real-time Live Packet Inspection: Microsoft 365 does not provide raw TLS network stream pcaps for SaaS traffic. Responders observe transaction logs, not raw packets.
• Accessing Historical Message Trace Beyond 90 Days: SMTP delivery records older than 90 days are irrevocably erased by Microsoft infrastructure; no support ticket can restore them.
• Recovering Purged UAL Events on Disabled Tenants: If tenant administrators previously ran Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $false, no operational logs exist for that duration.

---

Prerequisites and Dependencies

To inspect and collect all layers of the logging architecture, an investigator must verify:

1. Licensing Baseline:
   • Entra ID P1 or P2 (to unlock 30-day retention and Non-Interactive / Service Principal sign-in logs).
   • Microsoft 365 E3 or E5 (to unlock 180-day UAL retention, Audit Premium, and Defender XDR hunting).
2. Role Assignments (Least Privilege):
   • Security Reader (Entra ID directory role for authentication and risk telemetry).
   • Audit Reader or View-Only Audit Logs (Purview role for UAL search).
   • View-Only Recipients + Compliance Management (Exchange Online roles for Message Trace).
3. Tenant Feature Configurations:
   • UnifiedAuditLogIngestionEnabled = $true (tenant-wide UAL pipeline active).
   • Mailbox audit logging enabled (AuditEnabled = $true on target mailboxes).
   • Entra Diagnostic Settings configured to stream logs to an external workspace (see Fiche 04 — Preparing a Microsoft 365 Tenant for DFIR).

---

Forensic Artifacts and Logs: Architectural Cross-Reference

Forensic Investigation Question	Primary Log Source	Secondary Correlating Source	Key Identification Fields
How did the adversary authenticate?	Entra Sign-in Logs (SignInLogs)	Defender IdentityLogonEvents	CorrelationId, IPAddress, UserAgent, ConditionalAccessStatus
Which emails were delivered or sent by the attacker?	Exchange Message Trace	UAL ExchangeItem (Send)	NetworkMessageId, MessageSubject, RecipientAddress, SenderAddress
Did the attacker access or read specific emails?	Purview UAL (MailItemsAccessed)	Exchange Mailbox Audit	MailboxOwnerUPN, FolderItems, InternetMessageId, LogonType
Which files were viewed or downloaded from OneDrive/SharePoint?	Purview UAL (FileDownloaded, FileAccessed)	Defender CloudAppEvents	SiteUrl, SourceFileName, SourceRelativeUrl, ClientIP
Did the adversary register a backdoor application or secret?	Entra Directory Audit (DirectoryAudits)	Purview UAL (ApplicationManagement)	ActivityDisplayName, TargetResources, InitiatedBy, ModifiedProperties
Did the adversary modify inbox forwarding or transport rules?	Purview UAL (New-InboxRule, Set-Mailbox)	Exchange Admin Audit	Parameters, UserId, ObjectId, ClientIP

---

Investigation Methodology: Mapping and Verifying Tenant Log Streams

Before performing root-cause analysis, verify the operational health and availability of all log streams.

PowerShell Pipeline Audit

# ==============================================================================
# Hermes Codex - M365 Logging Architecture Health Check
# Validates Entra ID, Purview UAL, Mailbox Auditing, and Diagnostic Settings
# ==============================================================================

Write-Host "[*] Auditing Microsoft 365 Logging Pipeline Configuration..." -ForegroundColor Cyan

# 1. Verify Purview Unified Audit Log (UAL) ingestion
Import-Module ExchangeOnlineManagement -ErrorAction Stop
Connect-ExchangeOnline -ShowBanner:$false

$adminAuditConfig = Get-AdminAuditLogConfig
if ($adminAuditConfig.UnifiedAuditLogIngestionEnabled) {
    Write-Host "[+] Unified Audit Log Ingestion: ENABLED (Healthy)" -ForegroundColor Green
} else {
    Write-Error "[-] CRITICAL: Unified Audit Log Ingestion is DISABLED on this tenant!"
}

# 2. Check Mailbox Auditing default status
$mailboxAuditConfig = Get-OrganizationConfig | Select-Object AuditDisabled
if (-not $mailboxAuditConfig.AuditDisabled) {
    Write-Host "[+] Tenant-wide Mailbox Auditing: ENABLED (Default)" -ForegroundColor Green
} else {
    Write-Warning "[-] Mailbox Auditing is globally DISABLED!"
}

# 3. Verify Entra Diagnostic Settings via Microsoft Graph
Import-Module Microsoft.Graph.Authentication -ErrorAction Stop
Connect-MgGraph -Scopes "Reports.Read.All", "Directory.Read.All" -NoWelcome

$diagSettings = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/reports/diagnosticSettings" -ErrorAction SilentlyContinue

if ($diagSettings.value.Count -gt 0) {
    Write-Host "[+] Entra Diagnostic Settings Active: $($diagSettings.value.Count) stream(s) configured." -ForegroundColor Green
    foreach ($setting in $diagSettings.value) {
        Write-Host "    -> Destination: $($setting.name) (WorkspaceId: $($setting.workspaceId))" -ForegroundColor Gray
    }
} else {
    Write-Warning "[-] WARNING: Zero Entra Diagnostic Settings configured. Ephemeral logs will age out!"
}

KQL: Cross-Plane Hunting

// ==============================================================================
// Microsoft Defender XDR - Cross-Plane Identity and Cloud Correlation
// Correlates an initial suspicious logon with subsequent file and email actions
// ==============================================================================
let CompromisedUser = "victim@domain.com";
let InvestigationWindow = 7d;

// 1. Identify suspicious sign-ins for target user
let UserSignIns = IdentityLogonEvents
| where TimeGenerated >= ago(InvestigationWindow)
| where AccountUpn =~ CompromisedUser
| where ActionType == "LogonSuccess"
| project SignInTime = TimeGenerated, IPAddress, AccountUpn, Application, DeviceName;

// 2. Correlate with CloudAppEvents (SharePoint, OneDrive, Exchange actions in UAL)
CloudAppEvents
| where TimeGenerated >= ago(InvestigationWindow)
| where AccountId =~ CompromisedUser
| where ActionType in ("FileDownloaded", "FileAccessed", "MailItemsAccessed", "New-InboxRule")
| project ActionTime = TimeGenerated, ActionType, Application, IPAddress, ActivityType, RawEventData
| join kind=inner (UserSignIns) on IPAddress
| project ActionTime, AccountUpn, ActionType, Application, IPAddress, RawEventData
| order by ActionTime desc

---

Investigation Scenario: The Multi-Plane Correlation

Case Context

A financial controller reports unauthorized wire transfer instructions sent from their mailbox.

Step-by-Step Architectural Reconstruction

1. Identity Plane Query: The investigator queries Entra ID sign-in logs (m365-09). An interactive sign-in is observed from IP 198.51.100.42 using a known residential proxy. However, MFA was bypassed using a session cookie (AiTM reverse proxy).
2. Workload Diagnostic Query: The investigator checks Exchange Message Trace (m365-15). A fraudulent outbound email to a banking institution is identified with NetworkMessageId = "f67b28..." sent at 14:22 UTC.
3. Compliance Plane Query: The investigator queries the Purview UAL (m365-13). At 14:15 UTC (7 minutes prior to the email), the event New-InboxRule is recorded, creating a rule named . configured to delete incoming messages containing keywords like wire, invoice, and fraud.
4. Data Plane Verification: The investigator checks MailItemsAccessed in Purview Audit Premium (m365-17). Over 450 confidential financial records were accessed between 14:02 and 14:20 UTC by the same residential proxy IP.

Without cross-plane correlation across Entra ID, Exchange Transport, and Purview UAL, the investigator would have seen only an outbound email, missing the compromised session token, the persistence rule, and the scope of data accessed.

---

The Transversal Doctrine: Logging Planes vs Forensic Proof

In cloud investigations, having a logging architecture does not equal forensic proof:

+-------------------------------------------------------------------------------+
|                      THE 7 LEVELS OF FORENSIC CERTAINTY                       |
|                                                                               |
|  1. Possible     -> Platform architecture supports logging the action.         |
|  2. Configured   -> UAL ingestion and Mailbox Auditing are toggled ON.         |
|  3. Authorized   -> Account had permissions to interact with the service.      |
|  4. Accessible   -> Network reachability and Conditional Access allowed access.|
|  5. Utilized     -> Adversary executed API calls against the target workload.  |
|  6. Observed     -> Telemetry record appears in Sign-in logs or UAL.          |
|  7. Proven       -> Multi-plane correlation proves end-to-end intrusion path.  |
+-------------------------------------------------------------------------------+

Critical Architectural Distinctions

1. Possible != Configured: While Purview can log MailItemsAccessed, it is not configured unless the user holds an Audit (Premium) license.
2. Utilized != Observed: An attacker may execute a search in Outlook Web Access, but if the event falls into an ingestion latency queue (or occurs during an internal Microsoft service degradation), the action was utilized but is not yet observed.
3. Observed != Proven: Observing an entry in SignInLogs with ResultType = 0 (Success) observes an authentication transaction. Proving that an adversary successfully operated the account requires correlating that sign-in with downstream application events in CloudAppEvents or UAL sharing identical session or IP signatures.

---

Common Pitfalls and Traps

Trap	Technical Root Cause	Investigative Impact	Corrective Action
Assuming UAL is Real-Time	Ingestion pipeline batches events from asynchronous service queues.	Concluding an attacker did nothing in the last 60 minutes because UAL returns empty results.	Always account for workload-specific latencies (up to 1h for Exchange, up to 24h for Teams).
Relying Solely on Sign-In Logs	Sign-in logs record identity events, not resource interactions.	Inability to determine data access, file exfiltration, or rule creation.	Always pivot from Entra Sign-ins to Purview UAL and Exchange Message Trace.
Assuming Default Log Retention Equals Long-Term Storage	Entra Free keeps logs for 7 days; Defender raw tables keep telemetry for 30 days.	Evidentiary extinction occurs before the investigation begins.	Implement Diagnostic Settings streaming to Azure Log Analytics immediately upon tenant onboarding.
Ignoring Ingestion Drops During Tenant Migrations	Hybrid or tenant-to-tenant migration tasks frequently disrupt audit logging.	Complete telemetry blackouts during critical transition periods.	Audit AdminAuditLogConfig and event rates during organizational restructuring.
Conflating Exchange Admin Audit with User Audit	Administrator audit logs (Set-Mailbox) are distinct from mailbox owner audit logs (MailItemsAccessed).	Responders search the wrong record types in UAL and conclude actions were not recorded.	Master UAL RecordType filters: ExchangeAdmin vs ExchangeItem.

---

2026 Feature State: Logging Architecture

Recent Changes

• Purview Audit Standard Default Retention: UAL standard retention is 180 days across all enterprise plans.
• Entra ID and Log Analytics Schema Parity: Complete schema alignment between Microsoft Graph API audit objects and the SigninLogs / AADNonInteractiveUserSignInLogs tables in Log Analytics.
• Global Secure Access (GSA) Integration: Sign-in logs and network traffic streams now include networkLocationDetails to explicitly indicate whether traffic traversed Microsoft’s Security Service Edge (SSE).

Deprecated Features

• Legacy Azure AD Graph API (graph.windows.net): Completely retired. All directory audit queries must use Microsoft Graph (graph.microsoft.com/v1.0).
• Exchange Online PowerShell v1/v2 Sessions: Retired. All administrative queries must utilize ExchangeOnlineManagement v3+ with REST execution.

Current Limitations

• Teams UAL Latency: Teams events still experience the highest ingestion latency across M365, with delays occasionally exceeding 12 hours during peak global service usage.
• Diagnostic Settings Stream Latency: While direct Graph API access reflects sign-ins within 2-5 minutes, streaming to third-party SIEMs via Event Hub can introduce additional queuing delays of 5 to 15 minutes.

---

Key Takeaways

1. Microsoft 365 is a distributed logging ecosystem: Master the distinction between the Identity Plane (Entra ID), Compliance Plane (Purview UAL), Diagnostic Plane (Message Trace), and Security Plane (Defender XDR).
2. Respect ingestion latency: Never clear an account or pronounce an incident contained without verifying logs outside the 1-to-24 hour ingestion buffer.
3. Correlate across planes: An authentication record in Entra ID means nothing without correlating it against resource access in the UAL and email transport in Exchange.
4. Establish external streaming: Relying on native platform retention is fatal in extended investigations; route logs continuously to Log Analytics or a SIEM.
5. Apply the 7-tier certainty doctrine: Never state that an action was proven when telemetry merely shows it was possible or authorized.

---

References

• Microsoft Learn: Microsoft Purview Audit (Standard) and Audit (Premium)
• Microsoft Entra ID: Sign-in logs schema reference
• Microsoft Learn: Search the Unified Audit Log
• Microsoft Learn: Advanced hunting data schema in Microsoft Defender XDR
• Office 365 Management Activity API schema reference