Cloud evidence moves on the provider's clock. Tenant configuration, licensing, audit settings, and provider retention decide which records exist long before an export begins. A collection that starts without the map often produces incomplete data and unrecorded gaps.
Document the tenant before the first export
The first task is to document the provider, subscription, regions, administrators, logging state, preservation features, connected applications, and custodians. Microsoft 365 record availability can vary by workload, license, audit configuration, retention policy, event age, and provider changes. An E5 license alone does not establish that a particular historical record exists. A SaaS export may omit deleted records, revision history, or administrative activity. Those differences shape the collection plan.
Prioritize time-sensitive sources
Sign-in logs, message trace data, and short-retention audit records can age out on a schedule shorter than the dispute. Those sources are captured first. Credentials and access are handled through the client's approved process. Examiners avoid changing tenant settings without a recorded purpose because enabling, disabling, or remediating a control may alter later evidence.
Correlate across identity, content, and endpoint
Cloud conclusions often require more than one log. Sign-ins can be compared with device records, mailbox activity, file revisions, sharing events, application-consent grants, IP intelligence, and endpoint telemetry. Provider timestamps and time-zone conventions are normalized before events are placed on one chronology.
- Record provider, subscription, region, and license context.
- Capture short-retention audit and sign-in data first.
- Retain provider-generated identifiers so extracts can be reproduced.
- Normalize time zones before building the chronology.
- Document what the platform could not supply, not only what it did.
Repeatable exports and documented gaps
Collection notes record queries, date ranges, export options, counts, checksums, errors, and provider-generated identifiers. If a platform cannot supply a requested field or historical period, that limitation is stated. A defensible record includes both what was obtained and what the system could no longer provide.