What we investigate
Start with the affected workload and user context. Establish what was accessible, what the AI service retrieved and what was actually disclosed or changed. Available evidence depends on configuration, retention and licensing.
Response work to agree
- Identify the relevant users, applications, connectors and source locations.
- Preserve available Microsoft 365 and identity records with authorised tenant administrators.
- Review sharing, guest access, app consent and connector permissions implicated by the event.
- Agree permission changes and recovery checks without making unrelated tenant-wide changes.
What safe recovery requires
An AI response may surface an existing access problem. Remediation should address the underlying sharing or identity boundary as well as the specific AI workflow.
Start with a non-sensitive brief
Use the incident brief builder or contact the team. Describe the affected service, observed impact and whether activity is ongoing. Availability, authority and delivery scope are confirmed before response begins.
Turn observations into investigation questions
| Observation | Evidence to seek | Decision to resolve |
|---|---|---|
| A user saw information outside the expected business scope | Identity, sharing permissions and available interaction records | Was the material authorised but unexpectedly discoverable? |
| An agent used a connector unexpectedly | Agent configuration, connection identity and destination audit | What access and action can be substantiated? |
| A suspicious source influenced an answer | Source version, interaction context and relevant detection record | Was there an attempted instruction or a confirmed effect? |
Plan collection around actual tenant visibility
Ask tenant administrators which audit and security records exist for the relevant workload, time window and licences. Do not assume every interaction or content item is retained. Scope separate identity, sharing and connector evidence alongside AI activity. Broader configuration review can follow containment through our Microsoft 365 security audit service.
What we agree to deliver
The scope identifies the questions to answer, records available, customer owners and permitted changes. Typical outputs include an event timeline, the affected boundary, approved containment actions, recovery checks and unresolved risks. The deliverables page explains how findings connect to evidence.
Continue with ai digital forensics, or compare response engagement options.
