To investigate a suspicious Outlook or OneDrive sign-in, compare its identity, client app, target resource, time, location, IP address and outcome with the user’s known activity—then check what the account did afterward. A strange location or risk alert is a lead, not proof of compromise. If you confirm active compromise, contain access while preserving a timeline of the activity.
1. Set the investigation window and scope
Record the affected user, the reported symptom, the first and latest suspicious events, and the Outlook or OneDrive resources involved. Start the log window just before the suspected activity and carry it through containment and remediation. Microsoft’s compromised-account guidance directs investigators to review logs from the onset of suspicious activity until remediation is complete.
As an Amazon Associate I earn from qualifying purchases.
Keep an incident timeline as you work. Note timestamps, observed events, actions taken, and user responses so that sign-ins and follow-on activity can be considered in sequence.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →2. Triage the sign-in in Microsoft Entra
In Microsoft Entra sign-in logs, examine the IP address, location, time, and whether the sign-in succeeded or failed. Interpret these details together with three questions: who signed in, which client application was used, and what resource was targeted. Microsoft explains these sign-in details in its sign-in log activity documentation.
#1 Best Overall
- Designed for Your Windows and Apple Devices | Install premium Office apps on your Windows laptop, desktop, MacBook or iMac. Works seamlessly across your devices for home, school, or personal productivity.
- Includes Word, Excel, PowerPoint & Outlook | Get premium versions of the essential Office apps that help you work, study, create, and stay organized.
- 1 TB Secure Cloud Storage | Store and access your documents, photos, and files from your Windows, Mac or mobile devices.
- Premium Tools Across Your Devices | Your subscription lets you work across all of your Windows, Mac, iPhone, iPad, and Android devices with apps that sync instantly through the cloud.
- Easy Digital Download with Microsoft Account | Product delivered electronically for quick setup. Sign in with your Microsoft account, redeem your code, and download your apps instantly to your Windows, Mac, iPhone, iPad, and Android devices.
Compare the event with the user’s routine and the incident timeline. Consider whether the app and resource make sense for that person, whether the time and geography fit their activity or travel, and whether repeated failures were followed by a successful sign-in. Microsoft’s compromised-identity SOP lists impossible travel, unfamiliar sign-in properties, password spray, MFA fatigue, and suspicious inbox-forwarding rules as possible triggers for investigation—not conclusive evidence on their own. See Microsoft’s SOP template.
- Identity and app: Is this the expected user and a client application they use?
- Resource: Was Outlook, OneDrive, or another resource accessed, and is that expected for this user?
- Time and location: Do they fit the user’s routine, travel, and reported incident window?
- IP address and outcome: Do the network details and success or failure pattern fit expected activity?
Validate the event directly with the affected user through an approved channel. Ask whether they recognize the location, device, app, travel, and any MFA prompt or account change. Record the response on the timeline. A user’s recognition or lack of recognition informs the assessment but should be considered alongside the logs.
3. Check account and service activity after the sign-in
Authentication records show access attempts; they do not, by themselves, establish what happened in the account. Correlate the sign-in with service and audit activity across the same timeline.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsReview Entra and Defender audit activity
Check Microsoft Entra audit logs for changes to users, applications, groups, or licenses. Microsoft describes Entra audit records in its audit logs documentation. Review Defender audit logs over a range beginning just before the suspicious activity; Microsoft recommends not narrowing the initial search to specific activities.
Rank #3
- FIDO2 CERTIFIED: FIDO Alliance Certified FIDO2 v2.1 and CTAP Level 1 for 2FA and MFA on Google Microsoft Apple GitHub login.gov AGOV SwissID and any WebAuthn service
- PASSKEY READY: Works as a hardware passkey for passwordless sign-in where the service enables it and as a U2F and WebAuthn security key everywhere else
- CERTIFIED SECURITY: NXP JCOP 4.5 secure element rated Common Criteria EAL6+ (augmented)
- TAP OR INSERT: Dual NFC ISO 14443 and contact ISO 7816 interface in an ID-1 format smart card that is passive and battery-free
- BUILT TO LAST: Passive smart card made in Switzerland designed by Swiss company Cryptnox and backed by a 2 year manufacturer warranty
Look for unauthorized mail and resource access
Use message trace and the mailbox’s Sent items to look for unauthorized outbound messages. Check for suspicious forwarding changes and other mailbox activity. Also assess whether the account accessed files or made administrative changes. Microsoft Entra risk-investigation guidance recommends reviewing resource access and possible data downloads: Investigate risk with Microsoft Entra ID Protection.
Defender XDR identity insights can draw on Entra AuditLogs and SigninLogs, as well as Office 365 OfficeActivity. What is available depends on the tenant’s configuration and service data collection; Microsoft describes the investigation view in Investigate Identities.
Rank #4
- STREAMLINED & INTUITIVE UI, DVD FORMAT | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
- OEM IS TO BE INSTALLED ON A NEW PC with no prior version of Windows installed and cannot be transferred to another machine.
- OEM DOES NOT PROVIDE SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
- PRODUCT SHIPS IN PLAIN ENVELOPE | Activation key is located under scratch-off area on label.
- GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.
4. Contain confirmed or active compromise
When compromise is confirmed or appears active, prioritize stopping unauthorized access while continuing the investigation. Microsoft says: “Disabling the compromised account is preferred and highly recommended until you complete the investigation.” Its compromised email account guidance describes disabling or blocking the user, resetting the password, revoking active sessions or refresh tokens, and requiring MFA re-registration as appropriate.
Review the account’s registered authentication methods and devices, and remove suspicious methods. Check user-consented applications and revoke access for applications that should not have it. Microsoft’s Entra risk-investigation guidance covers reviewing authentication methods and application access.
Best Value
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For session revocation, Microsoft documents the Microsoft Graph PowerShell command Revoke-MgUserSignInSession, which requires the User.RevokeSessions.All permission scope. Treat this as an administrative response action: confirm current requirements in Microsoft’s guidance and follow your organization’s change controls before using it.
5. Restore access and verify recovery
After the investigation, reset the password and restore the account if it was disabled. Check whether Microsoft has restricted the mailbox after spam or high-volume sending, and follow Microsoft’s recovery guidance if so. Continue to assess related account activity before considering the incident resolved.
6. Check access and evidence limits
Microsoft identifies the Reports Reader role as the least privileged role for viewing sign-in and audit logs; sign-in diagnostics launched from sign-in logs also require Reports Reader. This does not establish the permissions needed for every containment or recovery action. Check the current role requirements for the specific task before acting. See Microsoft Entra sign-in diagnostics.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Available logs and conclusions depend on the tenant. The cited Microsoft guidance does not establish a particular tenant’s retention period, licensing, telemetry configuration, or whether an individual sign-in is malicious. Verify what records are available in your environment and assess each event in context.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
