CISA shares guidance for Microsoft expanded logging capabilities

CISA published a playbook advising government and enterprise use of Microsoft Purview Audit (Standard) expanded cloud logs to improve forensic investigations and threat hunting after the Storm-0558 Exchange Online breach in 2023, which used a stolen Microsoft account signing key to forge tokens and exfiltrated an estimated 60,000 State Department emails; Microsoft later broadened logging availability following criticism.