Скачать или смотреть Caught at 2 A.M.: How Audit Logs Stopped Insider Data Theft in M365

This real insider threat case shows just how far someone will go and how powerful Microsoft Purview’s audit logs really are.

An employee used eDiscovery to search for sensitive terms like payment, wire, and transfer, then downloaded the results and copied them to USB for exfiltration.
Their attempt to cover their tracks?
Deleting the entire eDiscovery case at 2 a.m., hoping no one would ever notice.

But the audit logs told everything.

Purav breaks down:
• how suspicious logon hours (2 a.m.!) were the first red flag
• the sequence of eDiscovery operations that exposed the abuse
• why you should enforce time-bound role elevation for Purview
• how “case removed” events revealed the attempted cover-up
• why strong USB/DLP controls close the loop
• what this teaches us about insider risk and audit-driven detection

About our guest Purav
Purav Desai is a Microsoft Dual Security MVP with six years of experience specializing in Microsoft Security across multiple industries. He works as an M365 incident responder focused on cloud digital forensics and shares his expertise through talks and posts.

More content of Purav:
👉 DecipheringUAL GitHub: https://github.com/PuravsPoint/Deciph...
👉 PuravsPoint GitHub: https://github.com/PuravsPoint
👉 LinkedIn:   / purav-da346393  

Want more deep-dive insights like this?
👉 Check our monthly sessions on Luma: https://luma.com/international-data-s...
👉 Follow us on LinkedIn:   / international-data-security-user-group  

About us
The International Data Security User Group brings together data security professionals who want to learn, share experiences, and stay ahead of emerging risks. We turn Microsoft Purview challenges into clear, usable insights. Join our monthly sessions and level up your data security game.