Most of the people in your company are exactly who they seem to be. They work hard, they guard customer data and they report the strange email instead of clicking it. That is worth protecting, and the best way to protect it is to make sure facts, not stories, decide what happened when something goes wrong.
The risk that slips past most businesses doesn't come through the firewall. It comes from someone who already has a key, a friendly manner and a believable story. Sometimes that person misuses access. Sometimes they point at a colleague to cover their own mistake. The Microsoft 365 audit log records enough to tell the difference, if you keep the records and know where to look.
With mailbox auditing on, Microsoft 365 logs a MailItemsAccessed event when messages in a mailbox are read or synced (Microsoft's list of audited mailbox activities). Each record names the account that did the reading, the mailbox it read and the IP address it came from.
The LogonType field tells you how the reader got in:
If every record on a mailbox carries LogonType 0 and the owner's own account, no one else read it in that window. That answer clears everyone else at once.
No one reads another person's mailbox as a delegate until an administrator grants the permission. Exchange logs every Add-MailboxPermission change with the admin account that made it and the time. Line those grants up against the access records and the email trail. A grant that follows a written request is routine administration. A grant nobody asked for deserves a question.
Forwarding is a quiet way to watch someone. Exchange logs inbox rule changes and mailbox forwarding changes. Review them for rules that copy mail to another person, especially rules created during a dispute, a departure or a leadership change.
Microsoft Entra ID sign-in logs show whether an account signed in, was blocked or was disabled at a given moment. If an action carries the name of an account that could not sign in, someone else did it through delegated or administrative access.
Phishing accusations usually turn on a click. Microsoft records Safe Links clicks only when the tenant licenses Defender for Office 365 and the Safe Links policy tracks user clicks. Without that data, Microsoft's logs can't prove who clicked a link, including the person making the accusation. A missing click record settles nothing and should never count against anyone.
Audit records age out. Microsoft Purview Audit (Standard) keeps records for 180 days. For users with an E5 or equivalent audit license, Exchange, SharePoint, OneDrive and Entra ID records are kept for one year by default, and an add-on license extends retention to 10 years. Entra ID keeps sign-in logs for 30 days on P1 and P2 plans and seven days on free plans. Exchange message trace covers 90 days. Claims often surface months later, after the evidence is gone. Microsoft documents the audit retention rules in its Purview auditing overview.
MailItemsAccessed appears in your audit searches.Good logging isn't about suspicion. It lets your honest people do their jobs without worrying that a good story will outweigh the truth. If you want a clear picture of where your business stands, our cyber risk assessment covers access controls and logging along with the rest of your environment.
Inzo reviews Microsoft 365 audit settings, retention, mailbox permissions and forwarding rules for businesses in St. Louis and Louisville. If you want to know whether your tenant could answer an access question today, schedule a conversation with our team.