Verify that mailbox auditing on by default is turned on by running the following command in Exchange Online PowerShell: Get-OrganizationConfig | Format-List AuditDisabled Microsoft 365 base requirements Verify auditing settings

Account detailsīefore proceeding with the investigation, it is recommended that you have the user name, user principal name (UPN) or the email address of the account that you suspect is compromised. Here are general settings and configurations you should complete before proceeding with the phishing investigation. Investigation steps: Includes a detailed step-by-step guidance for this specific investigation.This checklist can be helpful in highly regulated environments to verify what you have done or simply as a quality gate for yourself. Checklist: Contains a list of tasks for each of the steps in the flow chart.Workflow: Shows the logical flow that you should follow to perform this investigation.

For example, logging that should be turned on, roles and permissions required, among others. Prerequisites: Covers the specific requirements you need to complete before starting the investigation.This article contains the following sections: The step-by-step instructions will help you take the required remedial action to protect information and minimize further risks. This article provides guidance on identifying and investigating phishing attacks within your organization.

Microsoft 365 free download