Skip to content

M365 Incident Response Tools

M365IncidentResponseTools is a Powershell module for incident response investigations.

It provides tools to collect sign-in logs, audit logs, user and mailbox info, device info, admin roles, message trace records. Also, tools for containment and remediation in M365 and Active Directory.

Start here:

Getting Started