Microsoft 365 Expert Witness

A compromised mailbox may be only one part of a wider event. GDF examines available identity, email, application and file records to assess the activity at issue and the resources an account or application could reach.

A dispute may begin with an email but turn on a shared document or account permission. The examination therefore starts with the tenant, accounts, services and dates relevant to counsel’s questions. We distinguish the material supplied for review from records that may still need to be preserved or obtained.

Depending on scope and availability, the examination can involve Exchange Online, Entra ID, SharePoint, OneDrive and Teams records. The work separates permissions from observed actions and distinguishes an authentication event from evidence of content access.

If an employee is alleged to have taken files before leaving, access rights alone do not answer the question. The analysis needs to examine recorded activity, the files involved and possible routine synchronization. A successful sign-in is a useful event, but it does not establish every subsequent action or identify the person behind the session by itself.

Which records support the proposed timeline? Does an event establish a download, a share or another action? Could an application identity explain activity attributed to a user? What records were retained, and which questions remain unanswered?

Available records may differ in time format, identifiers and retention. Correlation requires explaining those differences and identifying the accounts, applications and resources involved. Missing events can limit an opinion; they should not be silently treated as proof that nothing happened.

Findings identify the source records, relevant configuration and collection limits. Licensing, retention and audit configuration can affect coverage. The absence of an event is not automatically proof that no access occurred.

Counsel receives an explanation of which events support the proposed sequence and where the sequence depends on inference. Exhibits can separate account access, mailbox activity and document events. The opinion should identify the relevant record and its meaning rather than treating every audit entry as interchangeable evidence of misconduct.

A sign-in, a mailbox action and a file download may describe different parts of the same incident. We define the accounts, applications, resources and time period at issue, then compare the records available from each service. The collection plan includes shared resources where relevant, not just the named user’s mailbox.

Microsoft publishes definitions for audit activities. An opinion should use those definitions together with the actual event fields and tenant configuration. A sharing event may establish a permissions change without proving the recipient opened a document. A successful sign-in does not identify every item subsequently accessed.

In an illustrative employee-departure dispute, counsel may ask whether documents were copied before access was revoked. We compare retained identity and file activity, application access and relevant endpoint records. We separate the files the account could reach from the files that records show were accessed or transferred.

• Microsoft: audit activity definitions ↗

For microsoft 365 expert witness work, discuss the disputed questions and the experience needed before defining the engagement. Robert Knudsen is profiled in our expert directory. Meet the GDF team and discuss the technology, questions and availability with us. The expert selected for a matter depends on its scope and the required experience.