Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To investigate a suspicious Outlook or OneDrive sign-in, correlate the Entra sign-in record with the user, client application, target resource, and what the account did afterward. Check the event with the affected user, review audit and mailbox or file activity, and contain the account if compromise is confirmed or ongoing. An unfamiliar location or risk indicator is a lead—not proof of compromise.
1. Set the investigation scope and timeline
Record the affected user, the reported symptom, the first and latest suspicious events, and the Outlook or OneDrive resources involved. Start the log window just before the suspected activity and extend it through containment and remediation. Microsoft’s compromised email account guidance directs investigators to review logs from the onset of suspicious activity until remediation is complete.
Keep a single incident timeline as you work. Record timestamps, findings, actions taken, and the user’s answers so that later activity can be compared with the original event.
2. Triage each sign-in event
Review the event’s identity, application, and resource
In Microsoft Entra sign-in logs, examine the IP address, location, time, and whether the attempt succeeded or failed. Interpret these together with three dimensions: the identity (“who”), the client application (“how”), and the target resource (“what”). A record is more useful when you can determine whether the expected person used an expected app to access an expected resource. Microsoft explains the fields in its sign-in log activity details.
#1 Best Overall
- Designed for Your Windows and Apple Devices | Install premium Office apps on your Windows laptop, desktop, MacBook or iMac. Works seamlessly across your devices for home, school, or personal productivity.
- Includes Word, Excel, PowerPoint & Outlook | Get premium versions of the essential Office apps that help you work, study, create, and stay organized.
- 1 TB Secure Cloud Storage | Store and access your documents, photos, and files from your Windows, Mac or mobile devices.
- Premium Tools Across Your Devices | Your subscription lets you work across all of your Windows, Mac, iPhone, iPad, and Android devices with apps that sync instantly through the cloud.
- Easy Digital Download with Microsoft Account | Product delivered electronically for quick setup. Sign in with your Microsoft account, redeem your code, and download your apps instantly to your Windows, Mac, iPhone, iPad, and Android devices.
Compare the event with the user’s normal activity and your incident timeline. Look for patterns such as repeated failures followed by a successful sign-in, as well as activity that does not fit the user’s usual timing, location, application, or resource access.
Use risk signals as investigation leads
Microsoft’s compromised identity incident response SOP template lists impossible travel, unfamiliar sign-in properties, password spray, MFA fatigue, and suspicious inbox forwarding rules as example triggers. These warrant investigation, but none establishes compromise on its own. Travel, network routing, shared devices, and other legitimate circumstances can affect how an event appears.
Validate the event with the user
Contact the affected user through an approved channel—not by replying to a potentially compromised mailbox alone. Ask whether they recognize the location, device, application, MFA prompt, travel, or account change associated with the event. Add the response to the timeline; an unrecognized event raises concern, while a recognized one still needs to be assessed alongside the logs.
3. Correlate sign-ins with account and service activity
Check directory and Defender audit activity
Review Microsoft Entra audit logs for changes to users, applications, groups, or licenses. Microsoft describes the audit records in Learn about the audit logs in Microsoft Entra ID. Also review Defender audit logs starting just before the suspicious activity. Microsoft advises not to narrow the initial Defender search to selected activity types, which could exclude relevant actions.
Rank #3
- FIDO2 CERTIFIED: FIDO Alliance Certified FIDO2 v2.1 and CTAP Level 1 for 2FA and MFA on Google Microsoft Apple GitHub login.gov AGOV SwissID and any WebAuthn service
- PASSKEY READY: Works as a hardware passkey for passwordless sign-in where the service enables it and as a U2F and WebAuthn security key everywhere else
- CERTIFIED SECURITY: NXP JCOP 4.5 secure element rated Common Criteria EAL6+ (augmented)
- TAP OR INSERT: Dual NFC ISO 14443 and contact ISO 7816 interface in an ID-1 format smart card that is passive and battery-free
- BUILT TO LAST: Passive smart card made in Switzerland designed by Swiss company Cryptnox and backed by a 2 year manufacturer warranty
Look for mailbox activity
Use message trace and the mailbox’s Sent items to identify unauthorized outbound messages. Check for suspicious inbox forwarding rules as well. This can help establish whether a sign-in was followed by spam, business email misuse, or attempts to redirect mail.
Check resource access and other affected services
Look for file downloads, access to other resources, and administrative changes that may have followed the sign-in. Microsoft’s Entra risk-investigation guidance recommends reviewing resource access and possible data downloads. Defender XDR identity investigations can use Entra AuditLogs and SigninLogs, along with Office 365 OfficeActivity; see Microsoft’s Investigate Identities. The records available depend on the tenant’s configuration and service data collection.
Rank #4
- STREAMLINED & INTUITIVE UI, DVD FORMAT | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
- OEM IS TO BE INSTALLED ON A NEW PC with no prior version of Windows installed and cannot be transferred to another machine.
- OEM DOES NOT PROVIDE SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
- PRODUCT SHIPS IN PLAIN ENVELOPE | Activation key is located under scratch-off area on label.
- GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.
4. Decide whether the evidence supports compromise
Assess the event and its follow-on activity together rather than relying on one signal. Use this comparison checklist for each event or plausible explanation:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Identity and application: Was this the expected user, using a client application they normally use?
- Target resource: Did the event access Outlook, OneDrive, or another resource, and is that access expected for the user?
- Time and location: Do the timestamp and location fit the user’s routine, travel, and incident timeline?
- Network and outcome: Does the IP address and success or failure pattern fit expected activity, or does it align with other suspicious events?
- Follow-on activity: Do audit records, sent messages, forwarding changes, app consent, or file access indicate actions after the sign-in?
- User validation: Does the user recognize the sign-in, device, application, location, and MFA prompt?
A risk signal or unfamiliar location by itself does not answer whether the account was compromised. The conclusion should reflect the combined sign-in, audit, service activity, and user-validation evidence.
Best Value
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
5. Contain a confirmed or active compromise
When compromise is confirmed or active, prioritize restricting access while preserving the records needed for the investigation. Microsoft states in its compromised email account guidance: “Disabling the compromised account is preferred and highly recommended until you complete the investigation.”
- Block access: Disable or block the user as appropriate under your organization’s incident procedures.
- Reset credentials and revoke sessions: Reset the password and revoke active sessions or refresh tokens. Microsoft documents the Microsoft Graph PowerShell command
Revoke-MgUserSignInSessionand itsUser.RevokeSessions.Allpermission scope in the compromised-account guidance. Use it as an administrative response action, following current Microsoft documentation and your organization’s change controls. - Review authentication methods: Examine registered authentication devices and methods, remove suspicious ones, and require MFA re-registration when appropriate.
- Review app consent: Inspect user-consented applications and revoke access for apps that should not have it.
- Investigate account activity: Continue reviewing sign-ins, audit events, mailbox activity, and resource access to determine what happened before restoring access.
6. Restore access and check for lingering effects
After the investigation, reset the password and restore the account if it was disabled. Check whether the mailbox was restricted after sending spam or high-volume mail, and use Microsoft’s recovery guidance if it was. Restore access only after completing the investigation and addressing the suspicious authentication methods, sessions, and application access identified in the incident.
Permissions and tenant-specific limits
Microsoft identifies Reports Reader as the least privileged role for viewing sign-in and audit logs in its risk-investigation guidance. Sign-in diagnostics launched from sign-in logs also require Reports Reader; see How to use Microsoft Entra Sign-in diagnostics. These viewing permissions do not establish the role requirements for every containment or recovery action, so check the current requirements for the task before acting.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteLog retention, licensing, available telemetry, and the legitimacy of a particular event are tenant-specific. Verify what records your tenant retains and collects; the cited guidance does not determine whether any individual sign-in is malicious.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
