What may be examined
Microsoft 365 activity
Relevant Entra, Exchange, SharePoint and OneDrive records can describe different events. Confirm the tenant’s audit configuration and retention before relying on a particular history.
Access and download context
A download, sync event or permission change can have an ordinary business explanation. Correlate activity with the approved question and relevant system behaviour.
Device and account links
Computer records and cloud records may complement each other. Account attribution, shared devices and service accounts should be considered before attributing an action to a person.
Before an examination
Identify the authorised organisational contact, the specific concern, the relevant time period and permitted sources. Keep employee records and private messages out of the public enquiry. Agree privacy boundaries and handling with the appropriate adviser before examination.
What you can receive
A useful report distinguishes direct observations, reasonable technical inferences and unresolved questions. It identifies the records relied on and explains why a finding does or does not follow from them.
What the evidence may not establish
Technical activity is not a disciplinary decision. An account name is not conclusive proof of a person’s intent or physical actions. Unavailable logs may prevent a firm conclusion.
Questions before you begin
This service starts with an authorised, defined examination. Any proposed monitoring needs separate legal and privacy review and is not authorised through this enquiry.
The report must follow the evidence, including findings that do not support the original concern.