Cloud and SaaS
Microsoft 365 and Azure logs, signed and kept on the organization’s own servers.
Long-term retention for cloud audit logs
Cloud investigations often need records from several services and more history than a single console holds. Central retention in a SIEM gives the team a consistent place to follow that activity and preserve the evidence it needs.
Retention
Microsoft 365 and Azure retention depends on the service, license and configuration. Exporting audit records to a SIEM allows the organization to keep the history its investigations and reviews require.
API collection
Audit APIs need regular collection before available records expire. Collection health in a SIEM helps the team identify an expired credential, a delayed feed or another gap while there is still time to investigate it.
No tenant install
API-based SIEM collection reads permitted cloud records from a collector outside the tenant. The deployment defines the credentials, permissions and sources needed, without installing endpoint software inside the cloud service.
Account takeover
A sign-in from a new location may be harmless on its own. Connecting it with a forwarding rule or unusual file sharing gives the investigator a fuller sequence to assess, with relevant MITRE ATT&CK context.
Personal cloud and AI
DLP content and application controls can govern transfers to personal cloud accounts and AI services. Test the actual HTTPS upload and sync paths staff use, then provide a clear route for approved sharing.
Signed export
Signed log exports from a SIEM allow a reviewer to check record integrity outside the original console. The source events and collection history remain available to help explain what the record supports.
By scenario
Sign-in from a new place, then a forwarding rule
Correlate the sign-in and mailbox change, then review the account’s history and the destination receiving mail.
Audit log needed from eight months ago
A SIEM retention policy covering that period keeps the record available for search and export when the investigation needs it.
Collector credential expires
Collection-health monitoring in a SIEM makes the interruption visible so the team can restore access and account for any gap.
Employee syncs files to a personal cloud account
DLP application and content policies can restrict unapproved sync activity while allowing the organization’s approved collaboration tools.
Contract pasted into an AI chatbot
Inspection of a covered prompt or upload by a DLP can apply the contract’s handling policy before the information is shared.
Questions
Is anything installed in our tenant?
No. Collection runs from one agent on the organization’s own servers.
Where do the logs live?
Logs stay on the organization’s own servers.
Does ARRTECH check tenant settings or OAuth apps?
No. It records what happened. Posture checks belong to a CSPM or SSPM product.
Which cloud sources are supported?
The current integration scope includes Microsoft 365, Azure, Microsoft Graph and Elasticsearch. Evaluation checks the records each source supplies and any parser work needed for additional sources.
Who revokes a compromised session?
The identity administrator or an authorized SOAR workflow revokes it. The incident record should retain the evidence, approval and result of the action.
Guide
How long does Microsoft 365 keep audit logs?
Retention depends on the license, record type and tenant policy. Set the investigation history you need first, then configure collection and retention to preserve it.
How long does Azure keep activity logs?
Azure’s built-in retention is limited; export provides options for keeping activity records longer. Plan retention around the period your team needs to investigate and review.
Who is responsible for cloud audit logs?
Under the shared responsibility model, the customer stays responsible for its data, accounts and access in every cloud deployment.
How ARRTECH takes care of cloud and SaaS security
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
