Microsoft 365 Triage
Suspect a hacked mailbox or account? Investigate it right now, from your browser. Sign-in history, audit trail, inbox-rule and OAuth abuse - analyzed in seconds, with clear recommended actions.
First time in your tenant? An administrator must grant consent once (read-only permissions). New here? Read the help & data overview.
Who do we investigate?
Start typing a name or UPN. Pick the account you suspect is compromised.
Collecting evidence…
Everything is fetched straight from Microsoft Graph into this browser tab.
Findings by severity
Findings
| Severity | Finding | Time (UTC) |
|---|
Help
How to use the tool
- Sign in with Microsoft. Use an account with at least the Security Reader or Global Reader role. The very first time in a tenant, an administrator must grant consent once (the link on the start page opens the consent screen). All permissions are read-only - this tool cannot change anything in your tenant.
- Search the user. Type a name or UPN and pick the account you suspect is compromised.
- Choose the window. 7, 30 or 90 days back. Leave "Unified Audit Log" enabled for the most complete picture - it uses an asynchronous Microsoft query that can take a few minutes on busy mailboxes.
- Read the report. Findings are ranked by severity; click one for details and the recommended action. Export everything as CSV/JSON for your ticket or forensic archive.
Just looking around? The demo on the start page runs a staged BEC incident without signing in.
What data is pulled (and why)
Everything is fetched from Microsoft Graph straight into this browser tab. Nothing is sent to Limon-IT or any other server, and nothing is stored after you close the tab.
| Source | Graph API | What we look for |
|---|---|---|
| User profile | /users/{upn} | Account state, creation date, password age. |
| Sign-in logs | /auditLogs/signIns | Unexpected countries, brute force followed by a success, impossible travel, legacy authentication (bypasses MFA), Conditional Access outcome, risk level per sign-in. |
| Directory audits | /auditLogs/directoryAudits | Directory changes initiated by the account. |
| Identity Protection | /identityProtection/riskyUsers, /riskDetections | Microsoft's own risk verdicts: anonymous IPs, unfamiliar sign-in properties, leaked credentials. Needs Entra ID P2. |
| MFA methods | /users/{id}/authentication/methods | Whether strong methods are registered - and whether the user recognizes each one (attackers register their own authenticator). |
| OAuth grants | /users/{id}/oauth2PermissionGrants | Apps with access to the account, scored against risky scopes (mail read/send, mailbox settings, directory write). Malicious app consents survive password resets. |
| Unified Audit Log | /security/auditLog/queries | Inbox rules created or changed, mailbox-level forwarding, OAuth consents, admin role changes, mailbox searches ("invoice", "IBAN"...), mass file downloads, eDiscovery. |
What the report shows
- Critical - strong indicators of active compromise (forwarding to an external mailbox, password attack followed by a successful sign-in, MFA disabled). Act immediately.
- High - serious signals that usually accompany a real incident. Investigate the same day.
- Medium / Low - worth reviewing; often explainable but attackers hide in "explainable".
- Info - context, no action implied.
Every finding includes a recommended action. A step shown as skipped during collection means that source was not available in your tenant (licensing, permissions or auditing not enabled) - the report simply covers what could be read.
Findings are indicators, not verdicts - verify before acting. Suspect a real breach? Preserve the evidence exports and contact Limon-IT for incident response support.
Removing access
The tool holds no standing access: tokens expire after about an hour and nothing runs when the tab is closed. To remove it entirely, delete the enterprise application "Limon-IT M365 Triage" in your Entra portal (Enterprise applications → select it → Properties → Delete). That revokes the consent for the whole tenant.
📋 What's new
Everything added or changed in M365 Triage, newest first. The overlay after sign-in shows you only what landed since your last visit - this is the full record.