Microsoft 365 audit and investigation
Someone's account was phished three weeks ago. What has it done since?
Most Microsoft 365 investigations still mean stitching sign-ins, file events and mailbox traces into one timeline by hand - a day of work per account, and only while the events are still inside the retention window. 1Security keeps up to three years of history behind every account, already attributed to the file, the device and the location, so the answer to "what did they touch, from where, and how far could they have gone" is a filter, not a project.
The problem
The tip arrives late. The log has already moved on.
A departing employee downloaded "a lot" in their last two weeks. A contractor account behaved oddly before the contract ended. A phishing click from Tuesday reached the SOC on Friday. Every real investigation starts with a lead that is days or months old - which is why 1Security takes you from 180 days of audit history on standard licenses to three years, switched on the day you connect rather than the day after you needed it.
Even inside the window, one account means sign-in, file, mailbox and device records that each tell part of the story. Correlating one afternoon of one user across them by hand is an afternoon of your own, and it still does not tell you what the account could have reached but did not touch - which is the number management asks for first.
In a typical tenant an ordinary account can reach hundreds of thousands of files through groups, sharing links and inherited site permissions, and nobody has ever seen that number written down. So the impact section of the report becomes an estimate, and the timeline has gaps exactly where the interesting week was.
In practice
One account, taken apart in four steps.
How an investigation runs in 1Security - departing employee, suspected insider or a compromised login, the path is the same.
- 01
Open the account and read its reach
Open the user in Users. The drawer shows what the account can reach right now - sites, files, groups, mailboxes, links - resolved through every nested group and inheritance, plus its devices, its sign-in locations and its activity trend against its own baseline. The blast radius that used to take a day of scripting is one drawer, typically counted in the tens or hundreds of thousands of files.
- 02
Replay the window that matters
Switch to Activity logs and filter to the account and the date range - last week or last year, up to three years back. Every event names the file, the action, the app, the device (managed or not) and the country and city it came from, with the raw audit record one click away. Sort by severity to see the 40 downloads and the mailbox rule before the 4,000 file opens.
- 03
Read what sat below your alert line
Anomalies keeps every deviation down to two sigma above the account's own 30-day baseline as an info-tier episode - never mailed, never thrown away. Lower the sensitivity dial and the quiet Tuesday nobody alerted on shows up as "downloads 8x normal", without a rescan or a tuning period.
- 04
Check the origin, then close the loop
The travel trail says whether the account ever appeared somewhere its owner could not have been - two countries 900 km apart within an hour, a datacenter or Tor exit - and on which device. Findings become staged actions: expire the links, revoke the sessions, disable the account, each one logged in Actions with who approved it and when.
What makes it work
Memory, attribution and a baseline.
Three parts of the platform turn an audit export into an investigation you can finish before lunch.
Three years of audit history
Searchable, attributed activity - from 180 days to three years of retention on a standard license, with occurred-at and discovered-at timestamps kept apart.
Explore the audit tool →Locations with verdicts
Every event resolved to a country, city and network type. First-seen countries flagged, datacenter egress recognised for what it is, impossible travel called out on the timeline.
Explore travel detection →Alerts that keep receipts
Episodes instead of event spam, a sensitivity dial you set yourself, and an info tier that preserves everything down to two sigma for the day you need hindsight.
Explore the alerts tool →
FAQ
Common questions.
How far back can an investigation reach?
Up to three years of activity, on a standard Microsoft 365 license - three years of subscription builds three years of history, taking you from 180 days of standard audit retention to three years without a premium add-on. The audit history available at the moment you connect is backfilled; from then on nothing expires.
Do we need a premium license or an agent on the machines?
No. Retention, attribution, locations and anomalies all run on standard licensing with a read-only connection. There is nothing to install on endpoints; device attribution comes from the sign-in and audit records themselves.
Can we investigate quietly?
Yes. Investigating is read-only browsing of data 1Security already holds - filters, drawers and timelines. Nothing is sent, changed or announced unless you explicitly stage an action, and staged actions wait in their own review window.
What if the suspicious activity never triggered an alert?
That is what the info tier is for. Everything down to two sigma above the account's own baseline is stored and filterable even though nobody was mailed. Lowering the alert line reclassifies history at read time, so hindsight is a filter change, not a forensics job.
The 1Security platform
Audit & Investigation is just the beginning
Audit & Investigation is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- Email and mailboxesWho can read whose mailbox, forwarding rules, threads with sensitive content, inbound and outbound exposure.
- LicencesWhat is assigned, what is unused, and which bundle an action or feature still needs, so the upgrade you sell is the one the client needs.
- Security scoreThe score, its history, the controls behind it and the benchmarks, so the number on the board report means something.
- ComplianceNIS2, DORA, GDPR, EU AI Act, SOC 2 and HIPAA as requirements with a live status, attestations, dated snapshots and evidence packs.
- ReportsSix report types in PDF, PowerPoint, HTML, CSV and JSON, under your brand with the client’s name, one report per client across the whole book.
- AlertingInstant and digest channels per client, routed to the right people, themed under your brand or theirs.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
The next "did we miss something?" deserves an answer.
Connect read-only and the history starts building the same day - so the next departing employee, odd contractor or late phishing report is a ten-minute lookup instead of a lost weekend.
Or keep stitching the timeline by hand.