Investigate suspected SharePoint exploitation by correlating Microsoft Entra sign-in identifiers with SharePoint Online activity in Microsoft Purview Audit, then tracing file access, sharing changes, application consent and related Microsoft Defender incidents. Audit events are evidence to connect—not proof of exploitation on their own.
What to establish before searching
Start with the suspected identity and time window. Record the user, affected site or library, files of concern, suspected start time, and any sign-in anomaly or alert already known. Include enough time to cover both possible initial access and later activity, and document the time zone used so records can be compared consistently.
As an Amazon Associate I earn from qualifying purchases.
The goal is a defensible timeline and scope: which identity acted, through which session or token, on which resources, what access changed, and whether the activity connects to other Microsoft 365 services. Microsoft’s guidance on linkable identifiers in Microsoft Entra starts with sign-in records and the user object identifier around the suspected token-compromise time.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCorrelate sign-ins with SharePoint audit records
In Microsoft Entra sign-in records, look for a Session ID (SID) or Unique Token Identifier (UTI) that can be carried into audit searches. In SharePoint Online audit data, Microsoft maps these and related identifiers as follows:
#1 Best Overall
| Identifier in sign-in or token context | SharePoint audit field | What it helps connect |
|---|---|---|
sid |
AADSessionId in the App Access Context object |
Activity associated with the same Entra session |
uti |
UniqueTokenId |
Activity associated with the same token identifier |
oid |
UserObjectId |
The user object acting in the tenant |
tid |
OrganizationId |
The organization associated with the activity |
| Device ID | Device identifier, when available | Device context; Microsoft says it is available only for registered or domain-joined devices |
Search Purview Audit for SharePoint Online in the relevant time range, filter by the user and any available session or token identifier, and export the results for timeline analysis. Missing device information does not by itself resolve whether activity was legitimate; it may simply not be available for that device context. See Microsoft’s identifier mapping and token-misuse guidance.
If token misuse is suspected, Microsoft describes revoking active user sessions and tokens first, followed by forensic scoping of unauthorized actions across affected services. Treat containment as a response-team decision, and preserve the evidence and timeline needed to determine impact.
Interpret file, page and sharing events as sequences
Review SharePoint and OneDrive file and page operations alongside sharing records, rather than treating a single event name as a verdict. Microsoft’s audit activity reference describes FileAccessedExtended as continued access by the same person over an extended period, up to three hours, and FileModifiedExtended similarly for continued modification. These extended events are intended to reduce repeated-event noise; do not count each as an independent open or edit without checking associated initial events and surrounding activity.
Sharing events answer different questions at different stages. In Microsoft’s sharing-audit guidance, the invitation itself does not grant access: “The invitation grants no access to the resource at this point.” Check whether it was accepted or whether another access path was used.
| Audit event | What it indicates | What to verify |
|---|---|---|
SharingInvitationCreated |
An invitation was generated; this alone does not mean the recipient can access the resource. | Whether it was accepted, who received it, and whether the sharing was expected. |
SharingInvitationAccepted |
The external recipient accepted and received access. | The target identity, resource, time, and approval context. |
AnonymousLinkCreated / AnonymousLinkUsed |
An “Anyone” link was created and later used. | Creation and use as separate steps, plus the resource and timing. |
SecureLinkCreated / AddedToSecureLink |
A specific-person link was created and a target user added. | The target field and adjacent event details. |
AddedToGroup / SharingSet |
Access may have been granted through group membership, including where the target already has a directory guest account. | The target, group or sharing change, and whether it matches an approved action. |
For each sequence, establish who initiated sharing, what was shared, who received access, and whether access was accepted or used. The acting user and target user appear in sharing records; exported AuditData can include additional context. Use that detail to connect the event to the resource and the rest of the timeline.
Check for application consent as another access path
If suspicious access may involve an application grant, search the audit log for Consent to application activity. Inspect the record details, including the administrative-consent value, then inventory the applications and permissions to decide whether the grant was expected. Microsoft’s application-consent investigation guidance says a corresponding record may take 30 minutes to 24 hours to appear; retention and searchability also depend on the user’s Microsoft 365 subscription licensing. An immediate search with no result therefore does not establish that no consent event occurred.
Expand scope through Microsoft Defender
When the activity appears in Microsoft Defender incidents, use the incident overview and timeline to connect affected users and entities, evidence, response status, the incident graph, and underlying investigations. Microsoft documents automated investigation and response as collecting findings into an incident. The cited incident workflow lists Defender for Office 365 Plan 2 or higher, suitable security roles, and Search and purge as prerequisites; confirm the tenant’s current licensing and role setup before relying on those features. See Microsoft’s incident management and investigation guide.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Audit searches can be opened in Microsoft Defender or Microsoft Purview. Microsoft’s Defender portal audit-search guidance lists Exchange Online Organization Management or Compliance Management role groups, or Microsoft Entra Global Administrator or Compliance Administrator roles, among permission routes. Microsoft says it “strongly advocates for the principle of least privilege”: give each account only the permissions needed, and reserve Global Administrator for emergency use or cases without a suitable lower-privilege route.
Best Value
Investigate malware detections and blocked files
For a suspicious file or malware alert, identify the detection source in Defender quarantine or the relevant content-malware view. Search Purview Audit for FileMalwareDetected; Microsoft describes VirusVendor and VirusInfo fields in its audit data. SharePoint Online PowerShell’s Get-SPOMalwareFile returns detection details, including malware information and site and path context. Microsoft’s SharePoint malware-detection guidance describes the relevant investigation paths.
SharePoint uses Microsoft Defender for Office 365 sandbox scanning and Microsoft Defender for Endpoint signature-based protection. Scanning can be asynchronous and depend on factors such as file type and sharing status. When a file is detected as malware, access is blocked and a warning appears. Investigate the detection; do not unblock the file unless you are confident it is safe. Microsoft also describes submitting suspected false positives for analysis.
Build a conclusion from correlated evidence
Assess the records together before deciding whether the activity was unauthorized. Compare the acting identity and target, session or token identifier, application or guest identity where relevant, device context if present, resource scope, event sequence, and timing against expected work and approved sharing. Preserve raw audit details and exported context alongside any alert summaries, and account for possible delays, retention limits, licensing, and missing fields.
State conclusions at the strength the evidence supports: an unusual invitation, link use, file operation, or consent record can be a lead, but the official procedures do not establish that any one event alone proves exploitation. Correlated identity, resource, sharing, and incident evidence is what supports a defensible finding.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
