The Microsoft 365 Unified Audit Log, Now in Chat

June 9, 2026 · InfraScout Team

When an account looks compromised, the first question is almost always "what did it actually do?" — and the answer lives in the Microsoft 365 Unified Audit Log: the workload activity trail across Exchange, SharePoint, OneDrive, and Teams. Until now, InfraScout could read the Entra identity plane — sign-ins and directory audits — but not that data-plane activity. With this update it can. You can ask InfraScout to search the audit log directly during an assessment, and it walks the full search lifecycle for you, turning a tedious Purview portal workflow into a conversational investigation an AI client drives end to end.

Searching the activity log from the conversation

The Microsoft 365 audit search runs asynchronously: you create a query, it runs server-side at Microsoft, and the records come back once it finishes. InfraScout exposes that lifecycle so the AI can run the whole loop without you leaving the chat. It creates a query, polls until the search succeeds, then fetches the matching records a page at a time.

A query is just a set of filters over the audit log. You can narrow by record types, operations, user principal names, IP addresses, object IDs, and the service or workload involved, add a keyword, and bound it all to a date range — by default, the last 24 hours. So a question like "show me everything this user did in SharePoint yesterday" or "what touched this file last week" becomes a single conversational request: InfraScout builds the right query, waits for it, and returns the rows.

Because audit searches are queued at Microsoft and can take a little while to complete, the polling step matters. InfraScout checks the search status and only fetches records once the job has succeeded; ask for records too early and it tells you the search is still running and to keep polling, rather than handing back an empty or confusing result.

Shortcuts for the questions IR teams ask first

Building audit queries by hand means knowing which record types and operations map to the behavior you care about — knowledge that lives in scattered documentation and tribal memory. InfraScout ships three incident-response shortcuts that pre-fill the right filters for the most common investigations, so you can ask the question in plain language and skip the lookup.

• Non-owner mailbox access — surface mailbox reads by someone other than the mailbox owner, a core signal when you suspect an account or a delegate has been abused.
• Suspicious inbox rules — find newly created or modified inbox rules, a classic business-email-compromise tell where an attacker quietly forwards or hides mail.
• External file sharing — see files and folders shared outside the organization, the question that comes up the moment data exfiltration is on the table.

Each shortcut is a focused starting point: ask InfraScout to check for suspicious inbox rules across a tenant or for a specific user, and it runs the underlying search — audit_mailbox_access, audit_inbox_rules, or audit_external_sharing — with the filters already set. You can still drill in with a full custom query when an investigation needs something the shortcuts don't cover.

Recovering a search and reading results

Audit searches outlive a single message. If a conversation moves on before a slow search finishes, you don't lose it — you can list the audit log searches for a connection to see what's in flight and recover the one you started, then fetch its records when it's ready. Records come back paged, so a broad investigation reads as a sequence of pages you can walk through rather than one unbounded dump, and InfraScout keeps the full underlying audit detail for each event so nothing useful is flattened away.

TIP

Start broad, then narrow. Run a wide date range first to confirm there's signal, then add a user principal name, IP address, or operation filter to zero in. Because each search runs server-side, tightening the filters is cheaper than scrolling page after page of a noisy result.

One-time admin setup

Audit search reads from your tenant, so an administrator grants the matching application permission to the Entra app registration InfraScout uses. The audit log query API needs AuditLogsQuery.Read.All (or the workload-scoped AuditLogsQuery-*.Read.All equivalents if you prefer to limit it to specific services). The tenant must also have Purview Audit enabled — without it, the search API has nothing to return.

How far back you can look is bounded by your audit retention. Standard retention keeps activity for 180 days; with the right licensing, retention extends up to a year.

WARNING

The non-owner mailbox-access investigation depends on MailItemsAccessed events, and Microsoft only records those for mailboxes covered by E5 or Audit Premium. If a mailbox-access search comes back empty, confirm the licensing before concluding the mailbox is clean — the absence of events may mean the events were never logged, not that nothing happened.

When a search fails, InfraScout names the likely cause — which permission to grant, or that Purview Audit needs provisioning — instead of returning a bare error, so the fix is usually obvious from the message itself.

Try it

Open an assessment and ask an audit question — "did anyone outside the org get access to files in this site last week?", "check this mailbox for non-owner access in the last 30 days," or "are there any suspicious inbox rules on this tenant?" InfraScout builds the search, waits for it to complete, and returns records you can act on, all in the same conversation where you're running the rest of the review.

Questions or feedback? Reach us at info@infrascout.cloud.