Mapping Cloud Evidence Across Tenants Before Collection Begins

By Joseph Caruso, Founder, CEO and CTO, Global Digital Forensics

The Complexity of Multi Tenant and Post Acquisition Cloud Environments

Enterprises that have grown through mergers, acquisitions or decentralized regional operations rarely house all of their digital evidence inside a single, uniform cloud tenant. A parent corporation may run an enterprise Microsoft 365 environment with ninety day audit retention, while a recently acquired subsidiary operates on an unintegrated Google Workspace domain, an independent AWS account or a basic Microsoft licensing tier where detailed mailbox auditing was never enabled. When litigation, regulatory scrutiny or a security incident strikes across business units, a tenant by tenant inventory reaches every custodian and record source across the units, well beyond what one central administrator sees.

How a Cloud Source Map Protects the Matter

Working directly for retained counsel, internal audit and corporate security teams, Global Digital Forensics conducts rapid cloud evidence source mapping engagements at the outset of complex matters. We inventory every active and legacy tenant, identity federation boundary, administrative role owner, licensing tier and log retention clock across the organization and its subsidiaries. By documenting what each cloud provider records, how long those logs survive and what export rate limits apply before collection starts, we give trial attorneys and compliance officers a verified roadmap of the evidence position at the start of the matter.

What a Source Map Records

A cloud source map is a verified inventory that comes before collection. For each business unit it records the identity provider and its federation boundaries, every Microsoft 365, Google Workspace, AWS, Azure or Google Cloud tenant and account, the license tier of each, the administrators who can export from it, the audit and sign in logs it generates, the retention period of each log, whether any log is forwarded to a SIEM or archive, and the export method and rate limit for each source. It also records which activities each source logs, so the team knows on day one when a subsidiary on a basic license has mailbox auditing disabled and can plan around it.

The map works from the records within retention on the day it is built. For any log that aged out earlier, the gap register records the date and the secondary copies we look for, such as a SIEM, an archive or a prior export, so it is addressed directly. Services that were never connected to the identity provider, the shadow IT a regional office adopted on a corporate card, are traced through DNS, proxy and cloud access security broker logs. We ask about those logs because they often expose a source the enterprise did not know it had.

The value of the map for counsel is precision in the hold notice and the preservation letter. A hold that names every tenant, the specific logs to be preserved and the administrator responsible for each is a record of reasonable steps under Rule 37(e). Naming the sources turns a general instruction to preserve all relevant data into a specific plan IT can carry out, and that specificity is the footing against a spoliation argument. Our cloud and SaaS forensics page describes the providers and record types this inventory covers. Precision in the hold is also what lets the legal team answer a preservation challenge with a document rather than a narrative, and the map is that document.

Retention Schedules the Providers Publish

The urgency behind a source map comes from provider documentation rather than from us. Microsoft's audit log retention policies describe the Unified Audit Log as retained for 180 days on the standard tier, with one year and longer available through the appropriate licensing and configured retention policies. The Entra data retention reference lists sign in and audit log retention at seven days on the free tier and thirty days with Premium licensing. Google's data retention and lag times page lists retention per Workspace log type, with many retained for six months.

Those numbers vary tenant by tenant inside one enterprise. A parent on an E5 license with a one year audit retention policy and a SIEM may sit beside an acquired company on a Business Basic license with no retention policy and a Google Workspace domain that was never migrated. The map records the verified configuration of each, because headquarters settings often differ from those in the subsidiary where the custodians work. Where a subsidiary is a regulated financial services entity, its own obligations under 23 NYCRR Part 500 may have produced logs held at the subsidiary level.

Infrastructure accounts have their own clocks. AWS CloudTrail, Azure Activity Log and Google Cloud audit logs are retained for short default periods, and longer where the account owner configured export to storage, and the account owner in an acquired engineering team may be a departed founder. We identify those owners, confirm what has been exported, and recommend immediate retention changes under counsel's direction where a default period is about to close on something the matter needs. The map lists each such account with its owner and its clock, so every deadline is written down. Departed owners are escalated the same day.

Building the Map, Phase by Phase

The first phase is discovery through people. We interview the identity team, the administrators of each known tenant, the corporate development group that handled acquisitions and the security team that runs the SIEM, and we review the identity provider's application and federation inventory. Every acquisition in the relevant period gets a line item: what the acquired company ran, what was migrated, what was left in place and who holds the credentials. This phase routinely surfaces tenants that the general counsel's office did not know existed, and it protects the client by converting assumption into inventory before anyone relies on it.

The second phase verifies each source against the provider's own admin console or API. We confirm the license tier, the audit configuration, the retention policies, the forwarding destinations and the administrator roster, and we test an export from each to learn its format, rate limits and completeness. Verification matters because the interview answer is often what the configuration was supposed to be, and the console shows what it is. Each verified source enters the map with a hash of the configuration export and the date verified, so the map itself can be defended as a record.

The third phase is the gap register and the preservation plan. Sources whose retention is about to expire are flagged for immediate export, sources with disabled logging are flagged for enablement under legal direction, and sources with no reachable owner are flagged for escalation. The deliverable is a map that names every source, every clock, every owner and every action, and it becomes the backbone of the hold notice and the collection plan. Our guide to reconciling Teams, Slack and email collections picks up where the map leaves off. The gap register is reviewed with your attorneys before any collection begins.

Using the Map in Due Diligence, Litigation and Incident Response

In litigation, the map is the exhibit that shows preservation was systematic. It supports the Rule 26(f) conference, where the parties address preservation and the form of production under Rule 26, and it lets counsel negotiate custodians and date ranges from a position of knowledge. When an opposing party asserts that a source must exist, the map shows whether it does, what it retains and when it expires, and that answer is far stronger coming from a verified inventory than from an administrator's recollection at a deposition. It also narrows the negotiation to sources that actually exist.

For a security lead, the map is an incident response asset. The first hours of an incident are consumed by the question of which tenant holds the relevant logs and who can export them, and a map built in calm conditions answers it in minutes. Our forensic readiness planning service builds the map as a standing document, and our guide to preserving evidence during incident response describes how it is used when the clock is running and containment and preservation compete for the same administrators. A security team that already knows its clocks and owners spends those hours preserving rather than searching.

For a transaction team, the map is the diligence finding that reveals how an acquisition target actually logs and retains. A target with no audit retention and departed administrators holding root credentials is a different risk than its security questionnaire suggests, and the gap register becomes a list of integration tasks with a cost attached. Our cyber due diligence page and the guide to diligence before close describe that use in detail. Deal teams that run the map before signing learn what integration will cost, and those that run it afterward learn what the incident response plan should add, so the earlier the map is built the more it protects the client.

Preparing Your Tenant Inventory for Rapid Preservation

To accelerate a multi entity cloud examination, gather a list of all primary and secondary email domains, federated identity providers such as Okta or Entra ID, archive appliances and the designated Global Administrators for each business unit. Our guide to reconciling Teams, Slack and email collections covers the checks that follow once the map is built.

Whenever a high stakes dispute or cross entity incident arises, call Global Digital Forensics at (800) 868-8189 to lock down volatile multi tenant records while the rolling retention windows are open. The initial consultation is free.

Fields the Source Map Records for Every Tenant

A source map draws its value from the fields it verifies. This table lists what the map records for each tenant and infrastructure account, where that fact is confirmed and why it belongs in the hold notice or the collection plan. The verification column matters because the interview answer is usually the intended configuration and the console shows the real one. Read the last column as the sentence counsel can write into the preservation letter once the field is complete.

How to Begin and What Happens on the First Call

Bring a list of business units and acquisitions in the relevant period, the identity providers in use, the known tenants and their administrators, any SIEM or archive the security team operates and the matter's date range. The examiner asks what question the matter will need to answer, which custodians and units are implicated, whether a hold has issued, what retention settings are known and where the gaps are suspected. The conversation produces a written proposal that names the sources to be verified, the preservation exports to be made immediately, the interviews required and the form of the map and gap register, with timing driven by the number of tenants and the availability of their administrators. The initial consultation is free. Call (800) 868-8189 at any hour.

Technical References and Further Reading

Primary sources and provider documentation behind this guide: Microsoft Purview Audit and Google Workspace audit tools.

Authorities cited in this guide: Microsoft Purview audit log retention policies. Establishes the 180 day standard retention of the Unified Audit Log and the licensing needed for longer retention, as published by Microsoft and consulted October 2026. Microsoft Entra data retention reference. Establishes the seven and thirty day retention of Entra sign in and audit logs by license tier, as published by Microsoft and consulted October 2026. Google Workspace data retention and lag times. Establishes per log retention periods for Google Workspace audit data, as published by Google and consulted October 2026. Federal Rule of Civil Procedure 26. Governs the discovery conference at which preservation and the form of production are addressed, current text at Cornell LII.