← Back to feed
Authors & BlogsEmerging1 sourceMar 7, 2025 · 23:02via ThinkDFIR

Sunday Funday – Searching for searching

Brief

This week’s Sunday Funday challenge involves reviewing Microsoft 365 UALs so I figured what better excuse to get access to a dev tenancy. Originally I looked at how to request one of these from Microsoft, and then that fell into the “just hard enough basket” so I asked a friend who generously donated access to his Thanks Zach!

This week’s challenge asks the following question:

What log entries are left behind when the following scenarios occur:

  • A user searches their own mailbox
  • A user searches their own onedrive
  • An administrator searches their own mailbox
  • An administrator searches their own one drive
  • An administrator searches someone else’s mailbox
  • An administrator searches someone else’s onedrive

The first step was to get a couple accounts setup and (after making sure I assigned licenses, which I definitely didnt forget for the first little bit) generate some data.

Read more on ThinkDFIR