Blackpoint ITDR Historical Scan

One Valid Login Opens Every Door

A valid login doesn’t just get an attacker past your defenses. It gets them into everything that the login touches: email, files, financial systems, and every application connected to it. There’s no malware to catch, so the malicious activity can easily go undetected. For an MSP, a compromise that goes unnoticed becomes a question of what you missed and what it costs you.

See What Happened Before Identity Protection Started

The Historical Scan reviews up to 180 days of Microsoft 365 activity when a tenant is onboarded in Blackpoint’s Identity Threat Detection & Response (ITDR), uncovering identity threats, risky access, and suspicious behavior that existed before protection was in place.

Get Your Historical Scan
Identity Risk

Historical Activity Can Reveal Active Risk

A login from an unfamiliar device. A quiet inbox rule forwarding email to an outside address. A third-party app granted more access than it should have. These are the kinds of malicious activity that often exist in Microsoft 365 environments long before protection is enabled. If they aren’t identified and remediated, attackers can use them to access financial systems, redirect payments, and/or exfiltrate sensitive data.

Historical Visibility

What the Historical Scan Looks For

Suspicious Logins

Sign-ins from new devices, unfamiliar locations, and other anomalous access patterns.

Mailbox Manipulation

Inbox rules and external forwarding changes that signal a compromised mailbox.

Risky Access & Consent

Third-party app permissions and suspicious activity in Teams chats.

Actionable Findings

Every Finding Comes With Context and Next Steps

Findings include a summary from Blackpoint’s SOC, MITRE ATT&CK mapping, details on the IP address, or application involved, and remediation guidance.

View the Solution Brief
Sample Blackpoint ITDR Historical Scan finding showing SOC context, MITRE ATT&CK mapping, and remediation guidance
Customer-Ready Reporting

Turn Security Findings Into Customer Conversations

Executive Risk Summary

Total events, critical findings, and an overall outcome you can walk the customer through in minutes.

Customer-Ready PDF

Delivered complete, no manual editing or formatting required.

Available in CompassOne

Use it to support compliance reviews, cyber insurance assessments, and future reference.

Sample Blackpoint Forensic Report showing evidence and activity associated with a critical identity event
Forensic Reporting

Know Exactly What the Attacker Did

When a Historical Scan identifies a critical event, it automatically generates a Forensic Report that documents the attack and its impact.

  • Detailed evidence: See what the attacker accessed, changed, or attempted to do.
  • Customer-ready documentation: Turn findings into clear conversations about risk and remediation.
  • Proof of response: For active ITDR customers, the report also shows the actions taken to investigate and contain the threat.
Historical Scan + ITDR

Find Past Threats. Stop Future Ones.

The Historical Scan provides a look back at what happened before protection was in place. Once ITDR is active, Blackpoint continuously monitors identity threats using the same identity telemetry, detections, and SOC expertise that power Historical Scan findings.

<2min Average containment time with AI SOC Agent
18m An account disrupted every 18 minutes across the Blackpoint customer base in 2025
10+ years Of SOC data and intelligence
Historical Scan FAQ

Frequently Asked Questions

What is a Microsoft 365 Historical Scan?

A Microsoft 365 Historical Scan reviews up to 180 days of tenant activity to identify signs of compromise, risky access, suspicious logins, and other indicators of identity-based attacks.

What does the Historical Scan look for?

Historical Scan analyzes Microsoft 365 sign-ins, mailbox activity, inbox rules, external forwarding, application permissions, Teams activity, and other behaviors associated with identity compromise.

Do I need Microsoft 365 E5 to run Historical Scan?

No. Historical Scan works with standard Microsoft 365 licensing and does not require Microsoft E5 or Entra ID P2 licensing.

Can MSPs use Historical Scan during onboarding?

Yes. Historical Scan is designed to provide immediate security visibility when onboarding new Microsoft 365 tenants into ITDR inside the CompassOne platform.

Blackpoint ITDR

Get Your Historical Scan