Microsoft is expanding access to cloud logging to all customers for free, with more becoming available in September 2023. This came after they received strong criticisms as a result of the Storm-0558 breach. On July 11, Microsoft reported having quelled a cyberespionage campaigned carried out by a group they track as Storm-0558. The attackers had used forged authentication tokens to break into email accounts at U.S government agencies and other organisations. Some of the organisations they reached out to couldn’t find any evidence of compromise in their logs. The reason, the organisation was on an E3 license; and the log types that contained the corroborating evidence was part of Microsoft’s enhanced logging which only available on the more expensive E5 and G5 plans. This lead to criticisms from government officials calling that every organisation using a technology service like Microsoft 365 should have access to logging and other security data out of the box.
https://www.bleepingcomputer.com/news/microsoft/microsoft-expands-access-to-cloud-logging-data-for-free-after-exchange-hacks
https://www.darkreading.com/remote-workforce/microsoft-logging-tax-hinders-incident-response
This segment was created for the It’s 5:05 podcast