Microsoft 365 audit logs explained: what to look for
Microsoft 365 audit services can record supported tenant activity such as sign-ins, mailbox-rule changes, and permission changes. Those records are evidence — not a monitoring process by themselves. This guide explains what small-business owners and administrators typically look for when reviewing account-takeover risk, where to search, and how automated checks differ from opening Purview once a quarter.
The short answer
Event availability, fields, timing, and retention depend on the workload, license, audit configuration, and Microsoft service. Administrators can search available records in Microsoft Purview and related portals. InboxGuards does not replace Purview, Microsoft 365 Defender, Entra ID Protection, or your admin team. It reads supported audit records you authorize and alerts when configured indicators match.
What the audit log actually records for mailbox takeover review
Microsoft exposes many event types across Exchange, SharePoint, Teams, and Entra ID. Depending on the tenant and available records, account-takeover review often focuses on:
- UserLoggedIn and related sign-in events — available records may include IP address, approximate location, client, and result. An unexpected country or impossible travel pattern can warrant review.
- New-InboxRule and Set-InboxRule — inbox rules created or changed. Attackers create rules that delete, hide, or redirect security warnings and vendor replies.
- Set-Mailbox with forwarding parameters — external forwarding on a mailbox is a classic BEC persistence move.
- Add-MailboxPermission — someone granting themselves or another account access to a mailbox that is not theirs.
- Update user / Add member to role — MFA method changes and new admin role grants used to lock in access.
Not every compromise produces every event. Provider ingestion can delay when a record becomes searchable. Licensing and configuration can change which fields appear. Treat “no results” as incomplete evidence, not proof the tenant is clean.
How to check them yourself in Purview
In the Microsoft Purview portal, open Audit and run a search filtered by activity type and date range. Available results can be reviewed or exported, subject to Microsoft licensing, permissions, retention, and processing delays. Start with a narrow window around the suspected incident, then widen if needed.
Choose a review schedule and retention process based on your organization’s risks, licenses, contractual duties, and incident-response plan. A weekly search with no named owner is not a control. Write down who reviews, what they look for, where exports live, and how findings escalate to finance when payment instructions change.
A log is not the same as a monitoring process
Audit records sit quietly until someone queries them or a product watches them on a schedule. Whether Microsoft generates a built-in alert depends on the event, tenant configuration, license, and enabled security products. Higher Microsoft licenses can unlock additional Identity Protection and MFA reporting surfaces; standard Business plans still expose useful audit activity for many small teams, but coverage is not identical to premium security suites.
InboxGuards connects read-only and checks supported audit records at the fastest cadence available on standard Microsoft 365 and Google Workspace plans — no premium security licensing required — for configured indicators such as suspicious sign-ins, forwarding changes, inbox rules, and selected permission or MFA changes. It sends plain-English alerts and records monitoring activity, subject to provider and API limits. It does not guarantee uninterrupted operation or detection of every incident.
Manual review versus an automated alarm
Manual Purview searches are appropriate for investigations and for organizations that already staff a repeatable review. Automated monitoring is appropriate when the business wants scheduled checks and email alerts without buying a staffed SOC retainer. They are complementary: an InboxGuards alert can be a reason to open Purview; a Purview finding can justify changing detection rules or payment procedures.
InboxGuards costs $2 per user per month — $240 a year for a 10-person business, or $200 billed annually — and schedules checks at the fastest cadence available on standard plans. Hands-on remediation is not included; an optional $199 flat-fee remediation can be separately authorized. InboxGuards is an alarm, not a Microsoft security replacement and not a duty team watching your tenant overnight.
Practical signals that deserve same-day attention
Prioritize unexpected successful sign-ins from new countries, inbox rules that touch invoice or payment keywords, external forwarding that did not exist last week, mailbox permission grants to unfamiliar accounts, MFA methods added without the user’s knowledge, and admin role grants outside change windows. Pair technical review with payment-verification habits: confirm bank-detail changes out of band even when the email looks perfect.
For deeper Microsoft 365 context see Microsoft 365 email security for small teams. To put an alarm on supported audit signals, start at inboxguards.com/register or review pricing.