- Nationwide Digital Forensic & Cyber Investigation Services
In a cloud environment, identity is the perimeter and identity logs are the crime scene. Entra ID records who authenticated, from where, under what policy, and what changed in the directory afterward. Those records have short default retention, which is why cloud identity evidence is preserved in the first hours or not at all.
| Question | One line answer |
|---|---|
| How long are Entra ID sign in logs kept? | Commonly 7 days on lower tiers and 30 days with premium licensing unless exported. |
| Can we see which resources an intruder touched? | Yes, through Azure activity logs for control plane operations, retained about 90 days by default. |
| Does resetting the password evict the attacker? | No. Sessions, refresh tokens, and consented applications must be addressed separately. |
| What is the most common cloud persistence? | Added authentication methods, consented OAuth applications, and new privileged role assignments. |
| Do conditional access records help? | Yes. They show which policy applied and whether it blocked, granted, or was not evaluated. |
| Can logs be extended retroactively? | No. Diagnostic export must be configured before the events occur. |
| Term | What it means |
|---|---|
| Entra ID | Microsoft cloud identity service, formerly Azure Active Directory, that authenticates users to Microsoft 365 and Azure resources. |
| Sign in log | Record of each authentication attempt with user, application, address, device, conditional access outcome, and risk state. |
| Audit log | Record of directory changes such as user creation, role assignment, and authentication method registration. |
| Conditional access | Policy engine that evaluates conditions before allowing a sign in, with per attempt results recorded in the sign in log. |
| Service principal | The identity an application uses. Attacker created or hijacked service principals are a common durable backdoor. |
| Activity log | Azure subscription record of control plane operations performed against resources. |
Cloud investigations differ from endpoint work in one crucial respect: you cannot image the provider. Everything depends on logs the provider chose to record and the tenant chose to retain, which makes source inventory the first analytical task.
| Source | What it proves | Default retention |
|---|---|---|
| Interactive sign in logs | Who authenticated, from where, on what device, under which policy | Roughly 7 days without premium licensing, 30 days with it |
| Non interactive and service principal sign ins | Token based and application authentications that bypass user prompts | Same tiered window as interactive sign ins |
| Directory audit logs | Role assignments, new users, authentication method changes, policy edits | Roughly 7 to 30 days by tier |
| Consent and application grants | Applications granted standing access to mail, files, or directory data | Recorded in audit logs, so subject to the same window |
| Azure activity log | Control plane operations against subscriptions and resources | About 90 days unless exported |
| Resource diagnostic logs | Data plane activity such as storage access, only if enabled | Only what the tenant configured in advance |
| Identity protection risk events | Risky sign in and risky user detections with reasoning | Tier dependent, generally aligned with sign in log retention |
Tenants that stream identity logs to a log analytics workspace, a storage account, or a SIEM have a year or more of history available when an incident is discovered. Tenants relying on portal defaults typically have days. Since discovery frequently lags intrusion by months, that configuration choice usually determines whether root cause can be established at all.
Cloud intrusions follow recognizable patterns. Knowing the artifact each technique produces lets an examiner search precisely rather than trawling millions of authentication records.
A sign in with multifactor recorded as satisfied from an unfamiliar address and device, with no corresponding user prompt.
An audit record showing a new phone, app, or key registered on the account shortly after a successful sign in.
A consent event tying a new application to broad mail or file permissions, often with an innocuous display name.
New credentials added to an existing application, giving non interactive access that no user password reset affects.
Audit entries assigning privileged directory roles, sometimes to a newly created account with a plausible name.
Changes to federation settings, trusted domains, or conditional access exclusions that quietly disable protection.
Identity evidence establishes access. It does not by itself establish what data was reached. A complete finding correlates the Entra ID timeline with mailbox audit records, storage access logs, and endpoint telemetry so that each authenticated session is tied to the operations it performed.
If a cloud tenant compromise is suspected, we can preserve identity and activity records before the default window closes.
Preservation in a cloud tenant is a sequence of exports, each with its own expiry pressure. The order below reflects which sources disappear soonest and which carry the most analytical weight.
Revoke sessions and refresh tokens, disable rather than delete suspicious accounts, and export application and rule definitions before removing them. Deleting an attacker created service principal without capturing it first removes the clearest proof of the persistence mechanism.
Identity log retention is measured in days to weeks by tier, and expired data cannot be recovered.
Policy gaps, excluded accounts, and legacy protocol paths are routinely exploited, and the logs show it.
Replayed session tokens present as fully satisfied authentications from the provider perspective.
Refresh tokens and consented applications can continue functioning until explicitly revoked.
| Log type | Default window | Extension path | Investigative value |
|---|---|---|---|
| Entra ID sign in logs | About 7 to 30 days by tier | Diagnostic settings to a log analytics workspace or storage | Highest for access and session bounding |
| Entra ID audit logs | About 7 to 30 days by tier | Same diagnostic export path | Highest for persistence and privilege change |
| Azure activity log | About 90 days | Export to workspace, storage, or event hub | High for resource level actions |
| Resource diagnostic logs | Only if configured | Must be enabled per resource in advance | Essential for data plane access questions |
| Microsoft Sentinel | Configurable, commonly 90 days interactive | Long term and archive tiers | Best consolidated timeline source when present |
We investigate cloud tenant compromises for businesses, outside counsel, and carriers. Our examiners preserve identity evidence before it expires, reconstruct every unauthorized session, and identify the persistence that would otherwise survive remediation.
Tenant wide export of sign in, audit, consent, and activity records with documented methodology and hashing.
A bounded account by account timeline of unauthorized authentication and directory change.
Review of applications, service principals, authentication methods, and role assignments for attacker controlled access.
Linking identity sessions to mailbox, file, and storage operations to establish what was actually reached.
Assessment of diagnostic export, conditional access, and consent policy so the next incident is investigable.
Findings written for counsel, carriers, and regulators, supported by court qualified examiners.
Consultations are confidential. We work directly with affected businesses, with outside counsel, and with cyber insurance carriers and brokers nationwide.
Elite Digital Forensics is an independent digital forensics firm serving businesses, attorneys, and insurers nationwide. Our examiners include former law enforcement forensic examiners who have testified as court qualified expert witnesses in state and federal proceedings. We do not sell security software and we do not manage client networks, so our findings carry no conflict of interest when the question is whether an environment was adequately secured.
Every engagement follows documented chain of custody, defensible acquisition methods, and reporting written for attorney review, insurer submission, regulator response, or courtroom use. Work performed at the direction of counsel is generally treated as attorney work product prepared in anticipation of litigation. Call (833) 292-3733 or request a confidential consultation.
Retention depends on licensing and commonly runs from about 7 days at lower tiers to 30 days with premium licensing. Longer history requires diagnostic settings that stream logs to a log analytics workspace, storage account, or SIEM, and that configuration cannot be applied retroactively.
Identity logs establish authentication and directory change. Proving what data was reached requires the Azure activity log for control plane operations plus resource level diagnostic logs for data plane access, and the latter only exist if they were enabled in advance.
The usual causes are an attacker registered authentication method, a consented OAuth application, added credentials on a service principal, or a valid refresh token that was never revoked. Each of these survives a password reset and has to be identified and removed individually.
It is an attack in which a user is persuaded to approve an application that requests broad permissions to mail, files, or directory data. Once consented, the application holds access independent of the user password and multifactor settings, which makes it a durable and frequently missed backdoor.
It is not required, but tenants that stream identity and activity logs into Sentinel or an equivalent platform routinely have a year or more of searchable history. Without that, the investigation is limited to whatever remains inside the short default retention windows.
Interactive and non interactive sign in logs tenant wide, directory audit logs, the application and service principal inventory with permissions and credentials, and conditional access configuration. Those four cover access, persistence, and the policy context needed to interpret both.
This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder