In September, Microsoft detailed a run of attacks where someone calls your staff pretending to be the IT help desk. In one case the intruder signed in from an unmanaged device, spent about an hour inside, opened SharePoint files and read mail in Outlook, and left.
An hour doesn't sound like much. But the question that matters afterward isn't how long they were in. It's which files they opened.
If you can answer that, you make a short list of phone calls. If you can't, you call everyone and tell every client you don't know what was seen. For a law firm, those are two very different weeks.
The answer lives in your Microsoft 365 audit log, and most owners are surprised by how it actually works. On the licensing most small firms run, that activity is kept for 180 days. Not forever. About six months. And the detailed record of which individual email messages were opened isn't in that standard tier at all. It's a premium audit feature you have to be licensed for separately.
So the evidence you'd need has a shelf life, and nobody checks it until the week they need it.
Two things worth confirming before your next cyber renewal: how long your tenant actually keeps this data, and whether anyone at your firm has permission to search it.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email