Hacked email - sign-in logs older than 7 days

Stefan dE 21 Reputation points
2022-03-26T01:39:25.04+00:00

Hi,
My wife's email account was compromised and it seems people have been logging in for at least 7 days using IMAP. I would like to know how long this has been going on. The question is: how do I get sign-in logs older than 7 days? I understand I would need a different subscription. If I subscribe now, will those logs still exist or will the 30-day logging start from the moment of signing up with a new subscription?
Thanks!

Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,357 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,567 questions
Accepted answer
  1. Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor
    2022-03-28T05:27:32.317+00:00

    Hi @Stefan dE

    Since this question is related to Azure AD Sign-in logs, I have added the tag to "azure-ad-sign-in-logs".
    Thanks for your understanding.

    According to this link: How long does Azure AD store reporting data?
    187331-10.png

    Even if you switch to a premium subscription, you can only see up to 7 days of data.

    Besides, if you have the required licenses, you may follow this link to use Advanced Audit to search for the login events: Use Advanced Audit to investigate compromised accounts
    187279-11.png

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Stefan dE 21 Reputation points
    2022-03-29T12:54:49.687+00:00

    Thank you, that answers my question! Not that one I hoped for of course, but "don't ask the question if you don't want to hear the answer", right? ;-)

    Thanks for your input!

    0 comments