Suspicious cloud logins rarely exist in isolation. This workflow is useful because it shows how to pivot from an Office 365 alert into broader on-premises and cross-system activity. That makes it easier to determine whether the event is harmless, user-related, or part of a larger compromise.

1. Start from the Office 365 Dashboard

Open the Office 365 overview dashboard and filter for alerts tagged as notified. Then open the specific log entry tied to the suspicious login. This gives you the username and source IP address needed for the next steps.

Office 365 overview dashboard in Logmanager showing the suspicious login alert details
Fig. 1: Office 365 overview dashboard in Logmanager showing the suspicious login alert details.

2. Pivot on the IP Address

Filter for all activity from the suspicious IP address and remove filters that limit the view only to alerted events. This makes it possible to see the broader context, including activity that did not itself trigger an alert.

If the same source IP is tied to more than one username, investigate every related account. In the example, one of the users deleted many files, which immediately raises the severity of the incident.

Investigation in Logmanager showing the suspicious IP associated with multiple Office 365 usernames
Fig. 2: Investigation in Logmanager showing the suspicious IP associated with multiple Office 365 usernames.

4. Move to the Wider Environment

Copy the suspicious username and switch to the general log overview dashboard. Review all related actions in other systems, including Windows. Look for account creation, password resets, account enabling, or adding users to groups, as these may indicate privilege escalation or persistence.

Suspicious login investigation in Logmanager showing file deletion activity or broader cross-system actions
Fig. 3: Suspicious login investigation in Logmanager showing file deletion activity or broader cross-system actions.
Windows or cross-system activity in Logmanager showing account creation password reset or group changes after suspicious login
Fig. 4: Windows or cross-system activity in Logmanager showing account creation password reset or group changes after suspicious login.