What account-access records may exist?¶
title: What account-access records may exist? subtitle: The provider may record sign-ins, sessions, mailbox actions, authentication changes and application access in separate systems. slug: what-account-access-records-may-exist series: email-evidence section: provider-and-account-records card_type: question_card pathway_order: 31 section_order: 3 status: draft public_safe: true video_ready: true word_count: 656 estimated_read_time_seconds: 271 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - email evidence - account access - audit logs - sessions - mailbox actions sources: - title: 'Microsoft Learn: Search the audit log for mailbox activities' url: https://learn.microsoft.com/en-us/purview/audit-log-search-for-mailbox-activities - title: 'Microsoft Learn: Audit log activities' url: https://learn.microsoft.com/en-us/purview/audit-log-activities - title: 'Microsoft Learn: Identify Exchange inbox rules activities' url: https://learn.microsoft.com/en-us/purview/audit-log-search-mailbox-rules - title: 'Microsoft Learn: Sign-in log activity details' url: https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-in-log-activity-details - title: 'Microsoft Learn: Track identity activities with linkable identifiers' url: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-track-linkable-identifiers - title: 'Google Account Help: Secure a hacked or compromised Google Account' url: https://support.google.com/accounts/answer/6294825?hl=en-GB
What account-access records may exist?¶
The provider may record sign-ins, sessions, mailbox actions, authentication changes and application access in separate systems.
Script¶
When people hear “account records”, they often think of a list of successful logins.
That is only one part of the picture.
An email provider or organisational identity system may record several different types of account activity.
The exact records depend on the service, subscription, configuration, retention and way the account was accessed.
Start with sign-in records.
These may show successful and failed attempts, date and time, source IP address, approximate location, application, browser, operating system, authentication method, security-policy result and identifiers for the user, device, session or token.
A sign-in record usually shows an authentication event.
It doesn’t necessarily show every later action performed during the session.
Session and token records may help connect the initial authentication to later activity.
A user can remain signed in for a long period. A message may be sent without a new password entry at that moment.
An attacker may also use a stolen session or authorised application token rather than carrying out a conventional interactive login.
Mailbox audit records address activity inside the account.
Depending on the system, they may record actions such as sending as another mailbox, sending on behalf of someone, accessing messages, moving or deleting items, creating rules, updating mailbox settings or using delegated access.
Not every action is necessarily audited.
Different actions may be recorded for the mailbox owner, a delegate, an administrator or an application.
Shared mailboxes require particular care because several users may have legitimate access.
Rule and forwarding records can be important in compromise cases.
An intruder may create an inbox rule that hides replies, deletes warnings or forwards messages to another address.
The current rule configuration may not show when it was created or which user created it. Audit logs may provide the missing timeline.
Authentication-method records may show which methods were registered or used.
That may include password, authenticator application, security key, passkey, SMS, voice or another multi-factor method.
A successful multi-factor event doesn’t always mean the account holder knowingly approved the activity. The method, device, prompt and surrounding events still need interpretation.
Security records may show alerts, suspicious sign-ins, risk assessments, password changes, recovery changes, disabled methods or account-protection actions.
Connected-application records may show that a third-party app, mail client, API integration or automation service had access to the mailbox.
That matters because the email may have been sent through an application without a person using the provider’s normal web interface.
Device records may identify registered, managed, trusted or recently used devices.
These can strengthen a link between a session and a known system, but the label may come from registration or account history rather than a fresh physical examination.
Message trace and account access should also be kept separate.
Message trace shows how a particular email moved through the provider.
Audit and sign-in records show account and user activity.
One may confirm that the service sent the message while the other helps explain which session, delegate or application caused it.
Preserve the identifiers that allow those datasets to be joined.
Useful values may include the account ID, session ID, device ID, token identifier, Message-ID, network message ID, client application and exact UTC time.
The common mistake is:
“There was no suspicious login at the time, so the account wasn’t compromised.”
The message may have been sent from an existing session, connected application, delegated account or token.
The other mistake is to treat every account event as equally reliable and complete.
Provider logging has limits. Records can be absent because the activity wasn’t audited, the wrong dataset was searched, the retention period expired or the access route was different.
Ask what the system was capable of recording at the relevant time.
Then use the available account records to build a sequence:
who or what authenticated;
which session or application gained access;
which mailbox actions followed;
and how the message moved through the service.
That sequence is much more useful than a single line saying the account logged in.
Key takeaway
Account access is wider than login history. Preserve the records of what authenticated, what session was used and what happened inside the mailbox.
Related questions¶
- What can login history show?
- What records may link an email account to a device or recovery account?
- What if the sender’s account was compromised?
- Should I preserve the mailbox as well as the individual message?
Source notes¶
- Microsoft Learn: Search the audit log for mailbox activities
- Microsoft Learn: Audit log activities
- Microsoft Learn: Identify Exchange inbox rules activities
- Microsoft Learn: Sign-in log activity details
- Microsoft Learn: Track identity activities with linkable identifiers
- Google Account Help: Secure a hacked or compromised Google Account