Skip to content

HomeGuidesMicrosoft 365 monitoring guides

Start with the question your team is asking.

Decide what you need to monitor, who will investigate and how the software should be hosted before comparing product subscriptions.

Account compromised? Practical help for the investigation.

Recover a hacked or phished account

Contain access, inspect MFA and check what changed.Read the guide

MFA enabled, but the account was hijacked?

Understand Evilginx and authenticated session theft.Read the guide

Free fillable incident report

Record rules, message counts, actions and evidence.Read the guide

Does this need reporting to the ICO?

Document the risk assessment and notification decision.Read the guide

One task at a time: account recovery help.

Stop an account sending phishing emails

Contain access and add a temporary Exchange sender restriction.

Sign out a hijacked account

Find session revocation and understand its limitations.

Reset the business account password

Use the right process for cloud and hybrid identities.

Remove unknown MFA methods

Review registrations and handle methods that return.

Investigate malicious inbox rules

Inspect hidden rules and disable a verified malicious rule carefully.

Choose your monitoring approach

Do I need a SIEM with Microsoft 365?

Assess your existing Microsoft controls, the systems you need to investigate and the team handling alerts.Read the Microsoft 365 SIEM guide

Can I monitor Microsoft 365 without a full SIEM?

Understand the scope of a focused mailbox and sign-in monitoring tool.Compare monitoring scope

Which monitoring product fits?

Compare the capabilities and operating models of named alternatives.Browse the product comparisons

Could a different approach save money?

Use your actual costs and allow for infrastructure, engineers and any coverage you need to retain.Use the cost worksheet

Do I need a SIEM if I use CIPP?

CIPP has monitoring too. Decide whether you need a wider administration toolkit, focused alerts or a broader security platform.Read the CIPP monitoring guide

Looking at a specific problem?

Read about new inbox rules and external forwarding, unexpected sign-ins and the findings at St Johnstone FC and Binn Group.

See Vigil in a live demo.

We’ll walk through alerts, investigation and deployment, and answer questions about your environment.