Could different account tiers retain different records?¶

Yes. Subscription and licence tiers can determine which log types are generated, how long they remain and which export or archive features are available. Customers of the same provider may therefore have different evidence.

Entitlement can affect existence as well as access¶

A basic plan may offer short sign-in history, while advanced tiers add administrator, mailbox, API or security audits. Some records are never generated unless a feature is licensed and enabled. Upgrading later may not recreate historical data; downgrading can shorten access.

Provider marketing and features also change, so current documentation may not describe the event period.

Establish the historical service configuration¶

Identify the tenant, product, licence, enabled features and retention at the relevant time. Preserve applicable settings or documentation and check whether records were forwarded to a SIEM, managed service, archive or backup.

An absent record may reflect entitlement, configuration or expiry rather than deletion. The conclusion should specify which mechanism controlled availability.