Catching Collection in M365: Outlook and SharePoint Canary Tokens

Once a stolen token gives an attacker access to Microsoft 365, they often search mailboxes and file stores for valuable data before taking it. The speaker explored canary items placed where such searches land: messages in hidden Outlook folders and files in finance and HR areas of SharePoint. Alerts fire when those specific items are opened, using native Unified Audit Log events rather than another product. Tracking the internet message ID for mail and the list item unique ID for files keeps detection tied to the item itself instead of its subject or file name.

Two pilots ran in small business environments. The first deployed 50 Outlook canaries over three months and produced three alerts. One came from a departing employee who was collecting customer information for a new employer, showing that the same signal can catch insiders as well as external attackers. The second pilot added ten SharePoint files, but the team had removed invoice and wire lures to cut noise. A later business email compromise searched only for those removed terms, so no alert fired.

The main takeaways are that canaries detect collection whoever performs it, that filtering out lure terms is a bet on attacker intent, and that a baseline period before deployment helps tune noise. Mail sync events and file preview events proved too broad to rely on, and activity that never touches a canary goes unseen. Teams with limited tooling can still build useful detection from audit log data.