Where are my logs? A field guide to Microsoft 365 & Entra ID log sources

Entra ID collects several distinct log categories, and the biggest beginner mistake in an M365 incident is stopping at the first tab (User sign-ins (interactive)) in the Entra admin center⁵.

In modern attacks—AiTM phishing, device code phishing, ConsentFix, or Primary Refresh Token (PRT) replay—the victim often completes the initial interactive sign-in themselves (or hands over an OAuth code). After that, the attacker replays refresh tokens, session cookies, or app permissions silently. If you only check interactive logins, you see a clean login from the user's home IP and miss all the attacker's token refreshes in the Non-interactive sign-ins tab.

How to pivot across Entra ID logs

Because attackers split their footprint across login and API planes, knowing the join keys saves hours:

• SessionId: Ties interactive and non-interactive sign-ins together for one session lifetime. In an AiTM attack, seeing the exact same SessionId switch from the victim's ISP IP to an unfamiliar VPS or VPN IP minutes later is your smoking gun.
• UniqueTokenIdentifier → SignInActivityId: Links a specific token issuance in SigninLogs or AADNonInteractiveUserSignInLogs directly to the individual API calls made with that token in MicrosoftGraphActivityLogs (where the column is named SignInActivityId).
• CorrelationId: Groups every related retry or step within a single authentication attempt or directory operation.
• AuthenticationProtocol and IncomingTokenType: Lets you filter instantly for anomalies—for example AuthenticationProtocol == "deviceCode" for device code phishing, or IncomingTokenType showing primaryRefreshToken / refreshToken replay from an unmanaged device.

Retention and portal blind spots

Exporting Entra categories to a Log Analytics workspace, Azure Storage Account, or Event Hub is configured under Monitoring & health → Diagnostic settings in Entra ID and requires the Security Administrator role alongside at least one Entra ID P1 or P2 license in the tenant⁴. Unlike SigninLogs, MicrosoftGraphActivityLogs has no built-in table view in the Entra portal: if you haven't created a Diagnostic Setting for it, no HTTP-level Graph telemetry is retained anywhere.

While Entra ID proves who authenticated and got a token, the Microsoft Purview Unified Audit Log (UAL) answers what they touched once inside: which emails were read, which inbox rules were created, which SharePoint files were downloaded or shared externally, and what prompts went to Copilot.

Two architectural facts govern UAL investigations:

• It is independent of Entra licensing. Standard UAL retention is 180 days (historical records prior to October 17, 2023 were kept 90 days)¹.
• Premium retention follows the user's license, not the tenant. Audit (Premium) (included with Microsoft 365 E5 or the E5 Compliance add-on) extends Entra ID, Exchange, SharePoint, and OneDrive audit retention to one year—with a 10-year retention add-on available¹. However, retention is stamped per acting user: unlicensed accounts, shared mailboxes without an E5-licensed actor, B2B guests, or frontline accounts on F1/F3 still fall under Standard rules.

Three traps you will hit in the field

1. Tenant auditing on ≠ every mailbox covered. Checking the org-wide switch in Exchange Online PowerShell is step one:

   Get-OrganizationConfig | Format-List AuditDisabled

   You want AuditDisabled : False⁶. Even then, always check for mailbox-level bypasses (Get-MailboxAuditBypassAssociation | Where-Object { $_.AuditBypassEnabled -eq $true }), which attackers sometimes abuse to go silent. Also keep an eye on the three mailbox audit scopes—AuditAdmin, AuditDelegate, and AuditOwner: some AuditOwner events (like MailboxLogin or HardDelete) are not always enabled by default depending on mailbox configuration and tenant age.

2. The MailItemsAccessed throttling cliff. MailItemsAccessed is the critical audit operation that records whether a session performed a folder Sync (desktop Outlook caching an entire folder—meaning Microsoft recommends treating the whole folder as compromised) or a Bind (opening specific messages identified by InternetMessageId in two-minute buckets)⁷. It is enabled by default for E3 and E5 users⁷, but Exchange Online throttles Bind logging for 24 hours if a mailbox triggers more than 1,000 Bind operations in 24 hours, emitting a throttling indicator instead of every individual message ID.

3. Move off synchronous Search-UnifiedAuditLog on large queries. Search-UnifiedAuditLog in PowerShell breaks easily at 5,000 records per session and drops pages under timeouts. For real investigations, run asynchronous Purview Audit Search jobs in purview.microsoft.com or automate them via the Microsoft Graph Audit Log API (security/auditLog/queries).

If a tenant runs Microsoft 365 Business Standard/Premium or Office 365 E3 without Defender for Office 365, you will not have EmailEvents or Threat Explorer in Defender XDR. Exchange Online Message Trace becomes your primary source of truth for mail flow:

• Standard Message Trace (Get-MessageTraceV2 in PowerShell or the Exchange Admin Center UI): near real-time query across the last 10 days of inbound and outbound mail flow.
• Extended Message Trace (Start-HistoricalSearch or EAC downloadable report): reaches back up to 90 days, exporting a CSV with connector routing, TLS status, sender IPs, and message IDs.

Crucially, Message Trace lives at the transport pipeline, not inside the mailbox: even when an attacker hard-deletes phishing replies from Sent Items and clears Recoverable Items, outbound trace records remain intact.

People often mix up the two retention windows inside the Microsoft Defender portal: alerts and incidents stay visible for 180 days, whereas Advanced Hunting (and Defender for Office 365 Threat Explorer) only keeps raw event tables for 30 days². If a BEC occurred six weeks ago and nobody exported Defender tables, Advanced Hunting returns empty results even while old incidents still appear in the UI.

Each hunting table also depends on which Defender workload is licensed and active on the tenant⁸:

Because Entra ID and Azure RBAC use separate planes, M365 teams frequently forget Azure Monitor altogether. Yet every Azure subscription and management group emits AzureActivity logs with 90 days of free built-in retention—zero SIEM required to read them in the portal.

Whenever an attacker compromises a Global Administrator, toggles access elevation to grant themselves the User Access Administrator role at the root scope (/), grants themselves Owner on a subscription, reads Key Vault secrets, or wipes Azure backups and storage accounts (as documented in cloud extortion campaigns like Storm-0501), AzureActivity is where those subscription-level role assignments and destructive operations appear.

Think of Log Analytics / Microsoft Sentinel not as a primary telemetry generator, but as the consolidation layer where your Entra, Purview, Defender, and Azure logs sit side by side—and where you actually control retention beyond Microsoft's 7-to-30-day defaults.

Two nuances matter enormously for budget and coverage:

1. The "free OfficeActivity connector" trap. Connecting Microsoft 365 to Sentinel (OfficeActivity), ingesting AzureActivity, and ingesting Defender product alerts (SecurityAlert) are free of ingestion charges¹⁰. However, the Sentinel Office 365 connector only streams four UAL record types: Exchange, SharePoint, AzureActiveDirectory, and General (including Teams). It does not ingest MailItemsAccessed—meaning you cannot determine which emails an attacker read from OfficeActivity alone and must still query Purview UAL directly—nor does it include Copilot interactions (CopilotInteraction), Power Platform / Copilot Studio events, Purview DLP, or eDiscovery actions.

2. Choosing the right Log Analytics / Sentinel table plan³:

   • Analytics tier: includes 90 days of interactive retention when Sentinel is enabled on the workspace (extendable up to 2 years). Supports scheduled KQL analytics rules, fast joins, and UEBA.
   • Basic / Auxiliary Logs tier: discounted ingestion for high-volume, chatty streams where you rarely need 5-minute scheduled alert rules—ideal candidates are MicrosoftGraphActivityLogs and bulk AADNonInteractiveUserSignInLogs if budget is tight.
   • Archive / Sentinel Data Lake: low-cost cold retention up to 12 years for compliance and delayed incident response (e.g., investigating a fraud reported four months after the initial compromise).
   • Defender XDR raw tables: unlike SecurityAlert (free), streaming raw Defender XDR hunting tables into Sentinel incurs normal ingestion charges; keep their retention aligned with what you actually hunt past Defender's built-in 30 days³.