Team: Huntress Managed Identity Threat Detection and Response (ITDR)
Environment: Microsoft 365
Summary: Learn how Huntress Lookback scans 180 days of Microsoft 365 login history during tenant onboarding to detect, investigate, and remediate compromised identities.

In this Article

Overview
Before You Begin
How Lookback Works
View Your Lookback Results and Assessment
Frequently Asked Questions

Overview

When onboarding a Microsoft 365 tenant, knowing whether an attacker is already inside the environment is critical. Huntress Lookback provides historical visibility by auditing the previous 180 days of Microsoft 365 sign-in logs upon tenant onboarding completion.

Lookback runs Huntress Unwanted Access detections across your audit history to identify prior or ongoing compromises. If Lookback detects an active compromise, the Huntress Security Operations Center (SOC) investigates the signal, creates a critical Huntress Incident Report, and revokes active sessions for the affected identity. Any previously remediated compromises appear as forensic context within your enriched Identity Security Assessment report.

Before You Begin

Before running Lookback, make sure you meet the following requirements:

• An active Huntress account with Huntress Managed Identity Threat Detection and Response (ITDR) enabled.

• A fully onboarded Microsoft 365 tenant. Lookback initiates automatically once tenant onboarding finishes.

• Global Administrator or designated admin permissions in Microsoft 365 to authorize tenant connections.

How Lookback Works

Lookback runs automatically at onboarding without requiring manual configuration or partner action. Within 48 hours of onboarding a Microsoft 365 tenant, Lookback analyzes historical sign-in data across five key threat categories:

• Credential theft: Logins using stolen or compromised credentials.

• Token theft: Unauthorized access using stolen session tokens.

• Adversary-in-the-middle (AiTM): Sessions intercepted by proxy phishing attacks.

• Suspicious browser activity: Logins originating from unrecognized or anomalous user agents.

• Datacenter logins: Access originating from cloud hosting infrastructure or non-standard datacenters.

Handling Active vs. Historical Findings

• Active compromises: Findings with live attacker sessions trigger a critical Huntress Incident Report. The 24/7 SOC investigates the threat immediately and revokes active identity sessions to stop the attacker's access.

• Historical/Remediated activity: Findings that were already remediated before onboarding do not generate new incident alerts or account lockdowns. Instead, they are documented in the Identity Security Assessment to provide forensic context for client discussions.

View Your Lookback Results and Assessment

To access your Lookback findings within the Identity Security Assessment:

1. Log in to Huntress and select your organization from the dashboard.

2. From the main navigation menu, go to ITDR > Reports.

3. Select Identity Security Assessment.

Note: The assessment waits for Lookback analysis to complete (up to 48 hours post-onboarding) so that you receive one complete, finalized report.

Frequently Asked Questions

Do I need to manually configure Lookback for new tenants?

No. Lookback runs automatically the moment a Microsoft 365 tenant completes onboarding in Managed ITDR.

Are Lookback reports available for trial accounts?

Yes. Trial tenants receive the exact same production detections, 24/7 SOC investigation, session revoking, and report details as paid accounts.

How long does it take to receive Lookback findings?

Lookback completes its scan and populates findings within 48 hours of tenant onboarding.

What happens if Lookback detects an active compromise?

The Huntress SOC investigates the activity and issues a critical Huntress Incident Report. The SOC also revokes active sessions for the compromised identity to contain the threat.