Does a managed SOC monitor Microsoft 365?

Yes, if the offer includes it, and it has become essential. A managed SOC can monitor Microsoft 365 using sign-in and audit logs: unusual sign-ins, mail forwarding rules, consents granted to apps, admin role changes. It works from these logs rather than from message content. Auditing needs to be switched on and logs kept long enough.

This article is part of our series on managed SOC. For the general principle, see SOC for MSP: what it is and how it works.

Why Microsoft 365 is a prime target

Microsoft 365 brings together mail, files and identities. A compromised account opens up conversations with customers and suppliers, shared documents and often other connected apps. That is why many attacks start with phishing aimed at a Microsoft 365 account, then move on to payment fraud or data theft.

These attacks do not always touch endpoints, so an EDR may not see them. We cover these scenarios in Microsoft 365: the attacks MSPs do not see coming.

What the SOC watches in Microsoft 365

Signal	What it may reveal
Sign-in from an unusual country or device	Stolen credentials
A run of failed sign-ins followed by a success	Successful password attack
New mail forwarding or deletion rule	Mailbox compromise, fraud in preparation
Consent granted to an unknown app	Persistent access gained by an attacker
Admin role added	Privilege escalation
Mass external file sharing	Data exfiltration
Account authentication methods changed	Lasting account takeover

The SOC correlates these signals with each other and with other sources, such as the EDR. See What does a managed SOC monitor?.

What to check on the Microsoft 365 side

Is auditing on? The Microsoft 365 unified audit log records user and admin activity. Microsoft documents how to check that it is enabled; without it, some signals are lost.

How long are logs kept? According to Microsoft, audit records are kept for 180 days by default for most activities, and one year for some services with E5-type licences. Investigating an older compromise may need more: a SOC usually keeps its own copy of the events it collects.

Can the SOC act? To disable an account or revoke sessions, the SOC needs delegated rights, framed by the escalation procedure.

What happens when an account is compromised

1. The SOC spots a suspicious signal, such as a forwarding rule created right after a sign-in from abroad.
2. An analyst confirms the compromise.
3. The account is disabled and its sessions revoked, within authorised actions.
4. The SOC establishes what the attacker did: messages sent, rules created, files accessed.
5. The MSP resets access and removes malicious items, following the SOC’s recommendations.

See What happens when a managed SOC detects an attack?.

Frequent blind spots

A few areas are often overlooked when Microsoft 365 monitoring starts:

• Shared and service mailboxes, sometimes left without multi-factor authentication and rarely watched.
• Guest accounts invited for a project and never removed.
• Older authentication protocols, which do not support multi-factor authentication if they are still allowed; Microsoft documents how to block them.
• Third-party apps granted broad permissions long ago and forgotten.

Reviewing these points with the MSP during onboarding reduces noise and closes common entry points.

At Cyna

Microsoft 365 is one of the ready-made connectors on the Cyna platform, alongside Google Workspace. Connecting an environment is quick, and the scope of monitoring is set out in the contract concluded with your partner MSP.

Talk to an expert

Want to know what a SOC would see in your Microsoft 365 environment? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Is multi-factor authentication enough to protect Microsoft 365?

It stops a large share of password attacks, but not all: some phishing techniques steal the session after authentication. That is why monitoring sign-ins and account activity matters.

Can a SOC disable a compromised Microsoft 365 account?

Yes, if it has been delegated the necessary rights and the action is among those authorised in the escalation procedure. It can then disable the account and revoke its sessions quickly.

Can Google Workspace be monitored the same way?

Yes, depending on the offer. At Cyna, Google Workspace is one of the environments that can be connected.

Does the SOC see malicious attachments?

It sees alerts from mail protection tools when they are connected, and above all what happens after a click: a suspicious sign-in, a new rule, an approved app.

Do we need extra Microsoft licences for SOC monitoring?

Core sign-in and audit logs are available with standard business plans. Some advanced signals and longer retention depend on higher licence tiers; the SOC can advise on what is worth adding.