One Microsoft 365 Event, Every Log That Recorded It

Most engagements begin with a mailbox question: whether a message was sent, whether an account was taken over, whether an instruction was genuine. The answer almost always lives in the tenant around the mailbox. Entra ID records the sign ins, Exchange Online records the mailbox actions, SharePoint and OneDrive record the files, and Teams records the conversations, and we examine them together so the opinion describes the whole event rather than one view of it.

We define the tenant, the accounts, the services and the period around counsel’s questions, including the shared documents and permissions that an email dispute tends to drag in. Then we establish what has already been supplied, what still exists on the platform and what needs to be preserved before retention policies quietly close the window. Our email practice has analyzed hundreds of compromised accounts, and the first week is usually when preservation decides what the case can later prove.

If the first week is now, call (800) 868-8189 and we will tell you which tenant records to preserve before the retention window closes.

Depending on scope and what the tenant retained, the examination can draw on Exchange Online, Entra ID, SharePoint, OneDrive and Teams records together with application permissions and audit configuration. The work separates permissions from observed actions and separates an authentication event from evidence that content was actually accessed, because those are the distinctions a cross examination turns on.

In a departure matter we examine the file activity, the access rights and the routine synchronization that may explain recorded movement before anyone calls it exfiltration. A successful sign in establishes that a credential was used at a time and from a place. The actions that followed, and the person responsible for them, each require their own supporting evidence, and the report keeps those three findings apart.

Litigators who have been handed a sign in record as proof of exfiltration can ask us what the surrounding records would need to show before the argument is made in a filing.

We test the proposed timeline against the actual definitions of the audit activities: whether a record supports a download, a sharing change, a mailbox rule or some other action, and whether an application identity explains activity that has been attributed to a user. This is where most Microsoft 365 opinions are weakest, because the labels are easy to read and hard to read correctly.

We reconcile time formats, identifiers and retention across the relevant services and identify the accounts, applications and resources behind each event. Every gap is logged by service and date, and each event is read for exactly what it records and nothing more, which keeps the timeline sound for whichever side relies on it.

Bring the disputed timeline to a free initial consultation and we will tell you which events it relies on and which definitions they have to meet.

Findings cite the source records, the relevant tenant settings and the collection coverage. We assess licensing, retention and audit configuration because they decide how much the tenant ever recorded, and the report shows the evidence behind the opinion alongside the configuration that produced it. Before the opinion is formed we confirm the examiner’s relevant experience, conflicts and availability for the schedule.

We explain which events establish the sequence and where the chronology depends on inference. Exhibits distinguish account access, mailbox activity and document events, with the meaning and source of each entry clear enough for a judge, a juror and an opposing examiner to follow, and the examiner who built them is the one who explains them under oath.

To learn which examiner would sign the report and whether the schedule works, send us the service list and the key dates.

A sign in, a mailbox event and a file download can describe three stages of one incident or three unrelated moments, and only the surrounding record tells you which. We compare records for the scoped accounts, applications, resources and period, including the shared resources the account could reach, so the opinion addresses the connected tenant activity rather than a single log read in isolation.

We interpret audit activities using Microsoft’s own definitions, the event fields and the actual tenant settings. A sharing event may show a permission change while a separate record is needed to establish that the recipient opened the file, and a successful sign in does not identify every item accessed afterward. Those distinctions are small on the page and decisive in the courtroom.

In a departure dispute, counsel may ask whether documents were copied before access ended. We compare the retained identity and file events, the application permissions and any relevant endpoint records, and we distinguish the files the account could reach from the files the records show it accessed or transferred, so the finding presented is the finding the evidence can carry.

If a departure dispute is already on your desk, ask us to read the retained identity and file events before anyone equates the files the account could reach with the files it took.

Robert Knudsen, Computer Forensics and Cybersecurity Specialist, holds the CISSP and Certified Computer Examiner credentials together with Microsoft Certified Professional status, and has conducted hundreds of computer and mobile device examinations supporting federal and state court matters across the United States over eighteen years of forensic work, following twenty years with the New York City Police Department. Joseph Caruso, founder, CEO and CTO, was accepted by a federal court as an expert in computer forensics and computer science in COMLAB v. Kal Tire, a matter in which the court found the disputed emails fabricated.

Veronica Perez, Senior Computer Forensic Specialist, has been designated as a digital forensics expert witness in California, Oklahoma and South Carolina state courts and in federal court in Chicago and brings the mobile device side of a Microsoft 365 account into the examination. Meet the GDF team and ask for a current CV. The examiner assigned depends on the services and the questions in the matter, and selection, conflicts and availability are confirmed during scoping.

Conflicts and availability can be checked in one call; (800) 868-8189 reaches us around the clock, and the first consultation is free. Attorneys new to the subject can start with the digital forensics FAQ.