Key Takeaway: A file download in Microsoft 365 (M365) can trigger immediate concern, and audit logs rarely tell the full story. When IP, sensitive data, or insider risk is at stake, relying on cloud records alone leaves critical questions unanswered. Combining audit logs with endpoint evidence reveals what happened before key evidence disappears, providing the context needed to make informed decisions with greater confidence and defensibility.

When an employee resigns or is terminated, one of the first questions organizations ask is whether company information was accessed, retained, or improperly transferred prior to the individual's departure. As organizations continue to adopt cloud-based collaboration platforms, Microsoft 365 (M365) has become a primary source of evidence for investigating potential insider risk, data exfiltration, and IP concerns.

In many cases, investigators begin by reviewing M365 audit logs to understand what activity occurred. These audit logs provide valuable insight into user interactions with files, emails, and collaboration platforms. However, while audit logs are an essential component of any investigation, they often represent only part of the story.

Understanding both the strengths and limitations of audit logs supports defensible conclusions during a departed employee investigation.

What Microsoft 365 Audit Logs Can Tell You

M365 audit logs provide insight into a wide range of user activities occurring within cloud services such as SharePoint, OneDrive, Teams, and Exchange Online. Depending on licensing, retention settings, and tenant configuration, organizations may be able to identify activities such as:

• Access to files stored within SharePoint and OneDrive
• File retrieval and download activity
• Interactions with files shared through Teams
• Email and attachment activity
• User authentication and account access events

These records establish timelines, identify users associated with specific activities, and provide valuable context regarding actions that occurred within the M365 environment.

For organizations investigating potential data loss or IP concerns, audit records often serve as an important starting point.

The Challenge: Audit Records Lack Complete Context

One of the most common misconceptions in departed employee investigations is that a single audit event definitively answers what happened to a particular file.

For example, an investigator may identify an event indicating that a file was downloaded shortly before an employee’s departure. While this information is certainly relevant, the audit record alone may not answer several critical questions:

• Was the file actually opened?
• Was the file subsequently copied to removable media?
• Was it transferred to another device?
• Was the activity the result of an automated synchronization process?
• Did additional activity occur after the file reached the endpoint?

The answers to these questions often require additional sources of evidence beyond cloud audit records.

Modern Collaboration Platforms Increase Complexity

The interconnected nature of Microsoft's M365 services also creates challenges when interpreting audit activity.

For example, users may access documents through Teams while the underlying files are stored within SharePoint. Similarly, files synchronized through OneDrive may generate activity associated with synchronization services rather than traditional browser-based downloads.

Without an understanding of how these services interact, investigators may inadvertently misinterpret the significance of individual audit events.

This does not diminish the value of audit logs. Rather, it highlights the importance of evaluating audit records within the broader context of the technologies involved.

The Missing Piece: Endpoint Evidence

While cloud audit records provide visibility into activity occurring within M365 services, endpoint systems often contain evidence that explains what occurred after a file was retrieved from the cloud.

Depending on the circumstances, endpoint artifacts may provide information regarding:

• Local file access
• Download activity
• Application usage
• Recent document interaction
• Removable storage device usage
• File system activity

These artifacts enable investigators to determine whether files identified within cloud audit logs were subsequently opened, transferred, or otherwise interacted with on a local device.

In many investigations, endpoint evidence provides critical context that may not be available through cloud audit records alone.

Build a More Defensible Investigation

The most effective departed employee investigations rarely rely on a single source of evidence.

Cloud audit records establish that activity occurred within M365 services. Endpoint artifacts provide insight into how information was handled after it reached a user device. When evaluated together, these sources of evidence provide a more complete understanding of user activity and reduce the risk of drawing conclusions based on isolated events.

Organizations should consider an investigative approach that incorporates:

• Preservation of relevant M365 audit records
• Identification and preservation of endpoint devices
• Correlation of cloud and endpoint evidence
• Evaluation of activity within the technical and business context
• Documentation of investigative findings and methodology

This approach improves both the accuracy and defensibility of investigative conclusions.

Move From Audit Events to Defensible Conclusions

M365 audit logs have become an essential source of evidence in departed employee and insider risk investigations. They provide valuable insight into user activity occurring within cloud services and serve as the foundation for investigative timelines and conclusions.

However, audit records alone do not provide complete context regarding how files were subsequently handled after being retrieved from the cloud. The strongest investigations combine cloud-based evidence with forensic artifacts recovered from endpoint systems, allowing investigators to develop a more comprehensive understanding of user activity.

As organizations continue to expand their use of cloud collaboration platforms, the ability to correlate multiple sources of evidence will become increasingly important when responding to data exfiltration concerns, IP disputes, and other insider risk scenarios.

Learn more about Epiq Forensic and Collection Services.

Erwin Risher, Senior Forensic Consultant

Erwin specializes in digital investigations, eDiscovery, insider risk, and data protection. He works closely with HR, legal, and data privacy teams to address insider threats and safeguard sensitive data. His experience includes large-scale forensic investigations, civil and criminal casework, and training military investigators and lawyers.