Thread by @ITguySoCal

Forensic Investigations in o365 - a short thread on why it’s getting harder and not easier for investigators. 1) Historically the first thing we used to do was enable an EMS E5 trial license in the customer tenant, as that allowed us to have 6 months of MCAS logs. This is gone!

Now, when you enable an MCAS trial, you must manually enable audit logging against O365, so there is no retroactive logs that magically appear 😩… it gets worse tho.. let’s talk about Azure AD “free.” This is what “E1 or E3” gets you
You get 7 days of AAD sign-in and audit logs

Historically when you enabled an AAD P1 or P2 or EMSE5 trial, you could go back 30 days. Now? When you enable the trials, no retroactive logs magically appear. 😭
So at this point the only forensic logs available in O365 beyond 7 days is the Security and Compliance Center Log…

Normally that log is limited to 90 days unless you have an E5 or Compliance Add-on, which extends the logs to 1 yr (or the new 10 yr add-on sku). But there are some limitations of using the web interface (like only 5,000 records at a time, etc). But I’ll end this on a happy note.

I just learned that if you use PowerShell, you can search up to 365 days even without an E5 license! So that’s good news! 🤫Search-UnifiedAuditLog –StartDate <StartDate> -EndDate <EndDate>
o365reports.com/2021/07/07/mic…

@ev_maus made a great point in the comments below: with GDPR you may not want logs collecting EU citizen IP’s beyond the length of time they consented. So I’m this case forensics must take a back seat to compliance. 🤷🏻‍♂️

some context for this rant… I often get called by random businesses to investigate account takeovers in their O365 tenant. These businesses sometimes have the bare minimum licenses and thus it’s hard to give these people answers when the logs are truncated 🥺