Introduction of the Microsoft 365 Extractor suite>
Medium – Invictus Incident Response
If you already know and used the Office 365 Extractor you have come to the right place. The tool was a hit and is still heavily used to acquire the Unified Audit Log (UAL). Since then the original developers Joey Rentenaar and myself have left PwC where we developed it. Therefore, itâs time for an updated version, called the Microsoft 365 Extractor. This blog contains all the details. There were some issues with missing support for multi factor authentication (MFA), mainly due to the way credentials were requested and used in the script. Additionally, the script was a bit big and required some updating in general. Finally, Office 365 is gone, it is now called Microsoft 365.
Link: https://invictus-ir.medium.com/introduction-of-the-microsoft-365-extractor-suite-b85e148d4bfe