Microsoft expands free logging capabilities after May breach

Microsoft expanded free Purview Audit logging and doubled default retention to 180 days after Chinese APT Storm-0558 used a stolen Microsoft account signing key to forge tokens and access Outlook/Exchange Online mailboxes from roughly 25 organizations (including U.S. agencies), resulting in substantial email theft (reported ~60,000 State Department emails) and prompting collaboration with U.S. government cyber agencies to improve telemetry and detection.