analyzing-office365-audit-logs-for-compromise

To detect suspicious inbox rules and forwarding configurations in Office 365, you analyze the Unified Audit Log and mailbox configurations via Microsoft Graph API. This identifies risky forwarding setups and hidden rules that indicate account compromise.

The best way to check OAuth consent grants and mailbox delegation changes is to enumerate these configurations across multiple mailboxes and tenants. This identifies risky activity and attacker persistence by scanning for unauthorized consent grants and delegation modifications.

Yes, you can use the Microsoft Graph API to query Unified Audit Logs across multiple tenants and mailboxes. This approach supports scalable monitoring and verification of compromise indicators for incident response and threat hunting scenarios.

Yes, you need MSAL authentication and Azure AD credentials including your tenant, client ID, and client secret to analyze Office 365 audit logs. These credentials are required to authenticate and access the Microsoft Graph Unified Audit Log.

You generate structured JSON reports with risk scores and attack timelines by analyzing Office 365 audit logs and mailbox configurations. This produces structured outputs that map compromise indicators to support incident response and threat hunting activities.