Silo City ITBusiness email compromise readiness
Could you tell what a mailbox thief read?
When a Microsoft 365 mailbox is compromised, the first questions are what the attacker read, what they sent and whether they still have a way in. The tenant can only answer them if the right logs and settings were in place before the break-in.
Answer ten yes/no questions to see where you stand. Each one links to the Microsoft Learn page that shows how to check it. Your answers stay in this page and are never sent anywhere.
Why these ten
The first three decide whether an investigation has records to work from. If mailbox auditing, MailItemsAccessed or the unified audit log is missing, nobody can say which messages were read, so the self-check marks you not ready until all three are in place.
Retention decides how far back you can look. The next five close the ways attackers most often get into a mailbox or stay in it. The last one decides how fast your team moves once it happens.
Vigilus runs 281 checks, settings like these among them, in a read-only Microsoft 365 assessment, and its business email compromise playbook collects the mailbox evidence when an incident happens.