Blackpoint ITDR Historical Scan

One Valid Login Opens Every Door

A valid login doesn’t just get an attacker past your defenses. It gets them into everything that the login touches: email, files, financial systems, and every application connected to it. There’s no malware to catch, so the malicious activity can easily go undetected. For an MSP, a compromise that goes unnoticed becomes a question of what you missed and what it costs you.

Get Your Historical Scan

Includes a Historical Scan of up to 180 days of Microsoft 365 activity. Already a Blackpoint partner? Add a client tenant to ITDR to run your scan.

Blackpoint Cyber Historical Scan sample report preview
Historical Visibility

See What Happened Before Identity Protection Started

The Historical Scan reviews up to 180 days of Microsoft 365 activity when a tenant is added into Blackpoint’s Identity Threat Detection & Response (ITDR), uncovering identity threats, risky access, and suspicious behavior that existed before protection was in place.

Get Your Historical Scan
Identity Risk

Historical Activity Can Reveal Active Risk

A login from an unfamiliar device. A quiet inbox rule forwarding email to an outside address. A third-party app granted more access than it should have. These are the kinds of malicious activity that often exist in Microsoft 365 environments long before protection is enabled. If they aren’t identified and remediated, attackers can use them to access financial systems, redirect payments, and/or exfiltrate sensitive data.

Historical Visibility

What the Historical Scan Looks For

Suspicious Logins

Sign-ins from new devices, unfamiliar locations, and other anomalous access patterns.

Mailbox Manipulation

Inbox rules and external forwarding changes that signal a compromised mailbox.

Risky Access & Consent

Third-party app permissions and suspicious activity in Teams chats.

Actionable Findings

Every Finding Comes With Context and Next Steps

Findings include a summary from Blackpoint’s SOC, MITRE ATT&CK mapping, details on the IP address, or application involved, and remediation guidance.

View the Solution Brief
Sample Blackpoint ITDR Historical Scan finding showing SOC context, MITRE ATT&CK mapping, and remediation guidance
Customer-Ready Reporting

Turn Security Findings Into Customer Conversations

Executive Risk Summary

Total events, critical findings, and an overall outcome you can walk the customer through in minutes.

Customer-Ready PDF

Delivered complete, no manual editing or formatting required.

Available in CompassOne

Use it to support compliance reviews, cyber insurance assessments, and future reference.

Sample Blackpoint Forensic Report showing evidence and activity associated with a critical identity event
Forensic Reporting

Know Exactly What the Attacker Did

When a Historical Scan identifies a critical event, it automatically generates a Forensic Report that documents the attack and its impact.

  • Detailed evidence: See what the attacker accessed, changed, or attempted to do.
  • Customer-ready documentation: Turn findings into clear conversations about risk and remediation.
  • Proof of response: For active ITDR customers, the report also shows the actions that would have been taken by Blackpoint’s SOC to investigate and contain the threat if the tenant had active ITDR coverage.
Historical Scan + ITDR

Find Past Threats. Stop Future Ones.

The Historical Scan provides a look back at what happened before protection was in place. Once ITDR is active, Blackpoint continuously monitors identity threats using the same identity telemetry, detections, and SOC expertise that power Historical Scan findings.

<2min Average containment time with AI SOC Agent
18m An account disrupted every 18 minutes across the Blackpoint customer base in 2025
10+ years Of SOC data and intelligence
Historical Scan FAQ

Frequently Asked Questions

What is a Microsoft 365 Historical Scan?

A Microsoft 365 Historical Scan reviews up to 180 days of tenant activity to identify signs of compromise, risky access, suspicious logins, and other indicators of identity-based attacks.

What does the Historical Scan look for?

Historical Scan analyzes Microsoft 365 sign-ins, mailbox activity, inbox rules, external forwarding, application permissions, Teams activity, and other behaviors associated with identity compromise.

Do I need Microsoft 365 E5 to run Historical Scan?

No. Historical Scan works with standard Microsoft 365 licensing and does not require Microsoft E5 or Entra ID P2 licensing.

Can MSPs use Historical Scan during onboarding?

Yes. Historical Scan is designed to provide immediate security visibility when adding new Microsoft 365 tenants into ITDR inside the CompassOne platform.

Do I need to be a Blackpoint partner to get a Historical Scan?

You do not have to be a Blackpoint partner to get a Historical Scan. You will need a CompassOne login and a Microsoft 365 tenant. A Blackpoint representative will help set up your CompassOne login and connect your tenant. No credit card is needed to run the scan or get the report.

Blackpoint ITDR

Get Your Historical Scan

No credit card, no strings attached. An expert helps you deploy, and most partners are live in 30 minutes. Your Historical Scan runs when your first tenant is added.

What happens next

From Request to Results

  1. 01
    Connect

    Our team gets in touch and helps you get started. No credit card required, no strings attached.

  2. 02
    Deploy

    An expert helps you add a Microsoft 365 client tenant. Most partners are live and running a scan within 30 minutes.

  3. 03
    Look back

    Your Historical Scan identifies up to 180 days of suspicious activity in a Microsoft 365 tenant.

Not ready for a Historical Scan? Download the sample report.

Request your Historical Scan