Week 8, Day 3 — Audit Log & Insider Risk Management

Day 2 review — from discovery to forensics

• Ask: "The eDiscovery search found Payroll-Q4.docx and related emails. Legal counsel asks: who created the external sharing link on that file, and exactly when? Can eDiscovery answer that question?" — no. eDiscovery finds the content but not the action trail. That's the audit log's job.
• Ask: "If you could see every action every user has taken in M365 over the past 180 days — file opens, emails sent, sharing links created, admin changes — what would that data let you do that DLP alerts and eDiscovery alone cannot?" — reconstruct intent. DLP catches the violation at the moment it happens. The audit log shows the behaviour before and after — the pattern that tells you whether it was accidental or deliberate.
• Frame: the audit log is the forensic backbone of M365 security. Days 1 and 2 covered preservation and collection. Day 3 covers investigation — using the audit log to answer "who, what, when, and from where" — and then Insider Risk Management, which uses the audit log signals continuously to detect risky behaviour patterns before they become incidents.

Audit log structure, search operators, and Insider Risk Management

• The unified audit log — what it records — the audit log captures admin and user activity across all M365 workloads in a single searchable record. Coverage: Exchange (email sent, received, deleted, forwarded), SharePoint (file accessed, shared, deleted, moved, permission changes), OneDrive (same as SharePoint), Teams (message sent, deleted, channel created), Entra ID (sign-ins, MFA events, role changes, CA policy changes), Defender (alerts generated, cases created), Purview (DLP matches, eDiscovery cases, label changes). Retention: 180 days for E3/E5 (Standard); up to 10 years with Audit Premium (E5 add-on).
• Key audit record fields — every audit event contains: Date/Time (UTC), User (who performed the action), Activity (what they did — operation name), Item (what was acted on — file name, email subject, etc.), IP Address (where the action originated), Workload (Exchange/SharePoint/Teams/etc.), and Result (success/failure). These six fields are the foundation of every forensic timeline.
• Searching the audit log — navigate to Purview → Audit → New search. Filter by: date range, users, activity categories (all SharePoint activities, all Exchange activities, specific operations like "Created sharing invitation"), and file/folder keyword. Results are returned in reverse chronological order. Export to CSV for detailed analysis in Excel.
• High-value audit activities for security investigation — the most forensically valuable activities: SharingInvitationCreated (who created a sharing link and when), FileDownloaded (bulk downloads before a resignation), MailboxLogin (sign-ins to a mailbox from unexpected locations), Add member to role (privilege escalation), Set-MailboxFolderPermission (mailbox access delegation), UserLoggedIn (sign-in events with IP and device details), DLPRuleMatch (every DLP policy match with matched content metadata).
• Insider Risk Management — a Purview solution that uses ML to analyse audit log signals, DLP alerts, Defender for Endpoint telemetry, and HR data to identify users exhibiting risky behaviour patterns. Key policy templates: Data theft by departing users (triggered when an employee resignation is signalled via HR connector), Data leaks (detects bulk sharing or download outside normal behaviour), Security policy violations (Defender alerts correlated with data movement). Insider Risk is not about surveillance — it is about detecting specific high-risk scenarios with privacy-protective controls: users are anonymised in the portal until an alert is escalated by a reviewer.
• Insider Risk privacy controls — by default, users in Insider Risk Management alerts are shown as anonymised (User123, User456) rather than by name. A reviewer must explicitly approve revealing the user's identity. This two-step process protects employee privacy while still enabling investigation of genuine risk. The anonymisation is controlled in Insider Risk Management settings.

Lab 8-C: Audit log reconstruction and Insider Risk Management setup

Students search the unified audit log to reconstruct the Week 7 incident timeline, export the audit results, analyse the forensic data, and configure an Insider Risk Management policy to detect data theft by departing users.

• Part 1 — Audit log investigation (40 min)
• Step 1 — Search for sharing events on the Finance site (10 min)
  Navigate to purview.microsoft.com → Audit → New search.
  · Date range: last 30 days (or adjust to cover the Week 7 lab date)
  · Activities: search for Shared file, folder or site (SharePoint sharing activities)
  · File, folder or site: type Payroll-Q4 in the search box
  · Users: leave blank (all users)
  Run the search. Look for SharingInvitationCreated or AnonymousLinkCreated events related to Payroll-Q4.docx.
  Click a result to expand the details — record the IP address, timestamp, and user who created the sharing link.
• Step 2 — Search for all admin changes in the last 7 days (10 min)
  Run a second audit search:
  · Date range: last 7 days
  · Activities: Role administration activities (all role changes)
  · Users: your admin account
  This surfaces the eDiscovery Manager role assignment from Lab 8-B. Verify it appears with the correct timestamp. This demonstrates that admin actions are auditable — even compliance-related admin actions leave a trail.
• Step 3 — Reconstruct the full incident timeline (15 min)
  Build a comprehensive audit search covering all activities related to the Week 7 incident:
  · Date range: the 48 hours around the Week 7 lab date
  · Activities: All SharePoint file activities + All DLP activities
  · Users: Priya Nair
  Review the results. Assemble them into a chronological timeline in the lab handout table — file access, sharing link creation, DLP match events, and any other relevant activities.
  Export the results to CSV: click Export → Download all results.
• Step 4 — Analyse the exported audit CSV (5 min)
  Open the downloaded CSV in Excel (or review in the portal if download isn't immediately available).
  Key columns: CreationTime, UserIds, Operations, ObjectId, ClientIPAddress, Workload, ResultStatus.
  Sort by CreationTime ascending to see the full chronological sequence. Record the most significant events — the ones that tell the story of the incident.
• Part 2 — Insider Risk Management (30 min)
• Step 5 — Configure Insider Risk Management settings (10 min)
  Navigate to purview.microsoft.com → Insider risk management → Settings.
  Review the key settings:
  · Privacy: confirm user anonymisation is On (users shown as User123 etc. until identity is approved)
  · Policy indicators: review which signals are available — Office activities (file downloads, email forwards), Endpoint activities (USB transfers, cloud uploads from MDE), Security violation indicators (Defender alerts)
  · Policy timeframes: review the default detection window (30 days of activity before an alert)
  Record the settings without changing them yet.
• Step 6 — Create a Data Leaks insider risk policy (20 min)
  Navigate to Insider risk management → Policies → + Create policy.
  · Template: Data leaks
  · Name: LL — Data Leaks Detection
  · Users: All users
  · Content to prioritise: add the Finance SharePoint site and the LL — Financial Data Protection DLP policy
  · Policy indicators: enable — Office indicators: Downloading files from SharePoint/OneDrive, Sharing files outside the org; Endpoint indicators (if MDE is connected): Copy to USB removable storage
  · Thresholds: use Microsoft recommended thresholds (default)
  Save. The policy begins analysing user behaviour immediately, but alerts typically take 24 hours to surface from a new policy.
  Record the policy configuration.

⭐ Bonus: Departing user policy and audit alert policy

Reflection & preview

• Ask: "The audit log showed that the Payroll-Q4 sharing link was created from an IP address you recognise. What if it had been created from a foreign IP address at 3am? What would that change about your investigation and your immediate response?" — it changes from a careless mistake to a potential account compromise. Immediate response: force password reset, revoke all sessions, check Entra ID sign-in logs for the suspicious sign-in, escalate to a security incident.
• Ask: "Insider Risk Management flags James Okafor as having downloaded 200 Finance files in one day. He is shown as User123 in the portal. What are the next steps?" — a reviewer examines the behaviour, decides whether to escalate, and approves revealing the identity. Only then is the user identified by name and investigation begins. This two-step process prevents false accusations.
• Preview Day 4: the audit trail is now documented. Day 4 goes back to sensitivity labels to complete the picture — adding encryption to the Confidential/Finance label so that a labelled file cannot be opened by unauthorised users even if it is shared externally, and configuring SharePoint library defaults so new Finance documents are automatically labelled.