Responding to a breach in Microsoft 365 Responding to a breach in Microsoft 365. Eli is phished, and an attacker signs in, creates an inbox rule and sends invoices from her mailbox. The order is contain, preserve, investigate, scope and notify. Logs disappear on different clocks: Entra sign-ins after 30 days, Identity Protection after 90, the unified audit log after 180 days with Audit Standard. Entra shows how the attacker got in, the audit log shows what they did, and Data Security Investigations shows which data was exposed. GDPR requires notification within 72 hours when personal data is at risk. W INVESTIGATION AND RESPONSE Responding to a breach in Microsoft 365 Ada Admin Eli Employee THE CASE Wednesday, 14 October: something is wrong The questions now: how did they get in, what did they do, and what did they see? THE ORDER MATTERS Five steps, in this order Containing first stops the damage. Preserving before you clean up keeps the evidence. 1 CONTAIN Lock the attacker out Document the inbox rule before you delete it. Screenshot, parameters, and the time you found it. 2 PRESERVE The logs run on different clocks Export the shortest-lived logs first. Work in UTC, and hash what you export. 3 INVESTIGATE: HOW THEY GOT IN Microsoft Entra shows the way in Identity Protection risk levels need Entra ID P2. Sign-in and audit logs need P1 or P2 to be kept 30 days. 3 INVESTIGATE: WHAT THEY DID AND SAW Purview shows what happened inside 4 SCOPE Who and what was affected QUESTIONWHERE TO LOOK 5 NOTIFY Check which reporting duties apply The clock starts when you become aware. The scope from step 4 decides what you report. THE USER EXPERIENCE What Eli noticed Nothing looked wrong until a customer called. Users see the symptoms. The logs hold the cause. Good to know 1/7 INVESTIGATION AND RESPONSE Responding to a breach in Microsoft 365 Eli is phished, and an attacker is in her mailbox. We go through the order of a response, which logs to save first, and what Entra and Purview each tell you about the breach. informasjonsbeskyttelse.no