Teams, Slack and Google Workspace Investigations

When an incident touches Teams, Slack or Google Workspace, investigators often find that the evidence they need was never logged, has aged out, or sits somewhere other than where they looked. Message content, audit events and sign-in records live in different stores with different retention, licensing and access rules, and the platforms log some actions and not others. This guide is for incident responders, SOC analysts and investigators working security and HR cases. It covers where each type of evidence lives, which logs answer which question, how to preserve and export it defensibly, and the gaps to plan for before the next incident. Legal holds and eDiscovery production are covered in the eDiscovery and Legal Hold Guide; this page is about investigating.

Key takeaways

Content and activity are separate evidence sets. Messages come from eDiscovery, export or Vault; who did what comes from audit and sign-in logs. Most investigations need both.
Retention decides what you can prove. Microsoft 365 Audit (Standard) keeps records for 180 days by default, and Slack's Audit Logs API is an Enterprise feature; check your tenant settings now, not during an incident.
Know where Teams stores things. Chats sit in participants' mailboxes, channel posts in the team's group mailbox, shared channel messages in a system mailbox reached through the parent team, and recordings in the recorder's OneDrive.
Apps and bots are actors too. Integrations post messages, read channels and download files with tokens, and their actions appear under app or placeholder actors, not people.
Preserve before you act. Place holds and export logs before disabling accounts, removing apps or purging messages, and record every step with hashes.

Common investigation types and the questions they raise

Case	Key questions	Primary evidence	ATT&CK
Compromised account used to message colleagues	When did the session start, from where, what did it post and to whom?	Sign-in and access logs, audit log, message content	T1078.004 Cloud Accounts, T1534 Internal Spearphishing
Data collection from channels and files	What was viewed, searched or downloaded, and was it shared externally?	File download and sharing events, Drive or SharePoint audit, export logs	T1213.005 Messaging Applications, T1530 Data from Cloud Storage
Malicious or over-privileged app or bot	Who installed it, what scopes, which channels, what did it do?	App install events, token and OAuth logs, app actor events	T1213.005, T1567 Exfiltration Over Web Service
External or guest access misuse	Which external users or shared channels had access, and what did they see?	Membership changes, guest sign-ins, shared channel content	T1078.004
Conduct or HR case (harassment, leaks)	What exactly was said, edited or deleted, and when?	Message content with edit history, holds in place	Not applicable

The Uber breach in 2022 is the reference case for the first two rows: after gaining a session through MFA fatigue, the attacker posted in a company-wide Slack channel and downloaded internal Slack messages. Responders needed sign-in records, the post itself and download activity, three different sources.

Microsoft Teams: where the evidence lives

Teams message data is held in Microsoft's own store, and eDiscovery works on the copies kept in Exchange Online, OneDrive and SharePoint. Microsoft Learn documents the locations:

Content	Messages	Files
1:1 and group chats	Exchange mailbox of each participant	OneDrive of the person who shared the file
Standard channels	The team's group mailbox	The team's SharePoint site
Private channels	Dedicated private channel mailbox; search owners' and members' mailboxes	Separate SharePoint site for the channel
Shared channels	System mailbox tied to the parent team; search the parent team's mailbox	Separate SharePoint site for the channel
Meetings	Standard meeting chat in participants' mailboxes; channel meeting chat in the team mailbox	Recordings and shared files in the recorder's OneDrive

Edits and reactions: edited messages are searchable, and previous versions are preserved only if the user is on hold. Reactions are available for content from 1 June 2022, and reaction history needs a hold.
Known gaps: anonymous meeting participants cannot be searched for, meeting recordings over 350 MB cause a processing error (the file can still be downloaded), and with Hide Attendee Names enabled the names are only in the organiser's mailbox.
Activity: Teams events (team and channel creation and deletion, setting changes and membership) go to the unified audit log once auditing is on. Private channel events are logged like any other channel. See the Microsoft 365 Unified Audit Log Guide for search and export.
Initiator trap: Microsoft notes that when membership is changed through Microsoft Entra ID, the Microsoft 365 admin portal or the Groups Graph API, the Teams audit record shows the team's existing owner as the initiator. Check the Entra ID and Microsoft 365 group audit logs for who really made the change.
Retention: Audit (Standard) keeps records for 180 days (90 days for records created before 17 October 2023). With E5 licensing, the default Premium policy keeps Exchange, SharePoint, OneDrive and Entra records for a year; other workloads, including Teams, stay at 180 days unless you create a custom audit retention policy. The licence of the user who generated the record decides what applies.

Slack: audit logs, access logs and exports

Audit Logs API: available only on Enterprise plans. It needs an app with the auditlogs:read user token scope, installed at organisation level by the Org Owner. Each event has an actor, action, entity and context, with app details where an app triggered it. Example actions include user_login, file_downloaded, file_downloaded_blocked and public_channel_created. Slack is explicit that the API is read-only, does not expose message content and covers only a subset of events.
Placeholder actors: some events are attributed to USLACKSECURITY or USLACKUSER rather than a person; do not read these as an unknown human.
Access logs: on paid plans, owners and admins can see the date and time of each sign-in, IP address and device. They update every 5 to 10 minutes during use. On Enterprise, workspace-level access logs do not show every mobile session, web visit or third-party app action, so use the access logs API for completeness.
Message content: exports depend on plan. Free and Pro export public channels; Business+ can apply (Primary Owner approval) to export all channels and DMs; Enterprise offers custom exports and single-user export of all conversations, requested through Slack Support. Members with the Export Admin role can run exports. Enterprise exports cannot be imported into another workspace.

Plan the Slack evidence path before an incident: an Enterprise organisation with no audit log integration has the data but no quick way to query it, and lower plans may have no audit trail beyond access logs. See the Slack Enterprise Security Guide.

Google Workspace: Reports API and Vault

Activity: the Admin SDK Reports API serves audit activity per application, including login, token (OAuth grants), admin, drive, chat, meet, groups, vault, takeout and gemini_in_workspace_apps. Access needs the admin.reports.audit.readonly scope.
Query windows: if no end time is given and the start time is more than 180 days back, the API returns the most recent 180 days; Gmail requests need both start and end times and cannot span more than 30 days. Page through results rather than relying on the console view.
Content: Google Vault is the retention, hold, search and export tool for Gmail, Drive and Chat content. Vault's own audit events (vault) show who searched and exported, which matters if the investigation itself is challenged.
Takeout: the takeout events reveal users exporting their own data, a common step in departing-employee cases.

See the Google Workspace Audit Log Detection Guide for event-level detections.

Where identity fits

A large share of collaboration platform activity is done by non-human identities: Slack apps and bots with user or bot tokens, Teams apps and Microsoft Graph applications with chat or channel permissions, and Google Workspace service accounts with domain-wide delegation. In an investigation, add them to scope explicitly.

Find the actor: in Slack audit events, app-triggered actions carry app details; in Google, the token application shows OAuth grants and revocations; in Microsoft 365, application sign-ins and service principal activity are in Entra ID logs.
Check the scopes: an app with history-reading scopes can read every channel it is in, and a Graph app with tenant-wide chat permissions can read every chat. The blast radius is the scope, not the user who installed it.
Revoke last: record the app's tokens, scopes and installer before you remove it. See How to audit Slack apps, bots and tokens and the Google Workspace Domain-Wide Delegation Security Guide.

Running the investigation step by step

Scope and authorise: write down the case question, custodians, date range and platforms. Get written authority from legal or HR for any access to message content, especially for staff conduct cases.
Preserve: place holds on the custodians' mailboxes, OneDrive, team mailboxes and SharePoint sites (Teams), apply legal holds in Vault (Google) and request the needed export or hold in Slack. Holds are what keep edit history and reaction history in Teams.
Collect activity first: export audit and sign-in logs for the window plus a margin, before they age out. Use the API or export rather than screenshots, and keep the raw files.
Collect content: run narrow searches (custodian, date range, keywords, message type), preview, then export. In Teams, search for instant messages and for .mp4 files if meetings matter.
Hash and log: compute SHA-256 hashes of every export, store them with the case record and log who did what. See the Evidence Handling and Chain of Custody Guide.
Build the timeline: merge sign-ins, audit events and message timestamps in UTC, noting each platform's time format. See the Forensic Timeline Analysis Guide.
Contain: only now revoke sessions, disable accounts, remove apps, or purge messages that spread malware or sensitive data. Microsoft's search and purge for chat messages exists for data spillage; purge only after the evidence is exported.
Close: record findings, retention of case data, and gaps found in logging, then fix them.

Choosing the approach

Security incident vs HR case: security incidents start from activity logs and expand to content; HR and conduct cases start from content and need tighter authorisation, a smaller custodian list and a reviewer outside the security team where possible.
Small organisations: on lower Slack or Microsoft 365 plans, the cheapest improvement is forwarding whatever logs exist to a SIEM or storage bucket with longer retention, so you are not limited by the platform's default window. See the SaaS Audit Log Retention and Licensing Guide.
Large or regulated organisations: licence premium audit for high-risk users, stream audit events continuously, and pre-build case templates with saved searches for each platform.
Privacy and lawful access: reading staff messages is monitoring. Use a documented policy, keep searches proportionate to the case question, and involve the data protection officer. UK readers should also check the UK Investigatory Powers Act Guide for the interception rules that apply to communications in transit.

Detection and measurement

Retention coverage: number of days of audit data available for each platform, compared with your required investigation window (aim for at least a year for high-risk users).
Log ingestion: percentage of collaboration platforms whose audit and sign-in logs reach the SIEM, with alerting on ingestion gaps.
Time to preserve: hours from case opening to holds and log exports completed.
App inventory: percentage of installed apps and bots with a known owner and reviewed scopes.
Detections worth running: bulk file downloads in Slack, mass external sharing in Drive, new apps with message-read scopes, Takeout exports by leavers, and posts to large channels from sessions with new IP addresses.

Framework mapping

Activity	NIST CSF 2.0	NIST SP 800-53 Rev. 5
Correlating sign-in, audit and content evidence	DE.AE-03	AU-6 Audit Record Review, Analysis, and Reporting
Establishing what happened and root cause	RS.AN-03	IR-4 Incident Handling
Recording investigation actions with integrity	RS.AN-06	AU-9 Protection of Audit Information
Collecting evidence with provenance	RS.AN-07	AU-9, IR-4
Generating logs and keeping them long enough	PR.PS-04	AU-11 Audit Record Retention

Common failure patterns

Auditing never switched on: Microsoft 365 records exist only from when auditing was enabled, so a tenant that never confirmed it has nothing to search.
Disabling first, preserving second: an account is deleted or an app removed before holds and log exports, and edit history or app activity is lost.
Searching the wrong mailbox: shared channel messages are missed because the investigator searched members' mailboxes instead of the parent team's.
Trusting the initiator field: a Teams membership change is attributed to the team owner when it was actually made through Entra ID or the Graph API by someone else.
Ignoring non-human actors: the investigation looks only at users while a bot token or Graph app was reading channels.
Screenshots as evidence: console screenshots without raw exports and hashes are hard to defend and impossible to re-analyse.

Practitioner checklist

Confirm Microsoft 365 auditing is on and record the retention each licence tier gives you.
Decide whether Slack Enterprise audit logs and the access logs API are integrated, and who holds the Org Owner and Export Admin roles.
Pull Google Workspace Reports API data into storage with longer retention than the default window.
Create custom audit retention for Teams activity of high-risk users if 180 days is not enough.
Keep a map of where Teams chats, channels, shared channels and recordings are stored.
Pre-agree authorisation rules with legal and HR for reading message content.
Include apps, bots, Graph applications and delegated service accounts in every investigation scope.
Preserve and export before disabling accounts, removing apps or purging messages.
Hash every export and log every action in the case record.
After each case, fix the logging gaps it exposed.

Collaboration platform investigations: finding and preserving evidence in Teams, Slack and Google Workspace