Curiosity is a useful starting point
Perhaps you have inherited an environment. Perhaps you are reviewing a client’s security. Or perhaps you simply want to understand what has been happening. A historical assessment can begin with a question, without a suspected compromise.
Ask what the record can tell you
Which identity actions deserve a closer look? What happened around them? Do related email, file, or application events explain the sequence? A back-scan brings earlier activity into the conversation.
Understand the window
A historical assessment depends on the evidence that is available. Microsoft audit retention can vary by licensing and configured retention policies. Establish the covered period and the sources included before drawing conclusions from missing events.
Start with Sentry Scan
Sentry Scan connects available Microsoft 365 history to help surface activity worth reviewing. It is a way to get a clearer baseline, whether you are investigating an incident or simply curious about the environment.