Your Microsoft 365 tenant has a history.
Lookback helps you see what happened before Huntress arrived - and who might still be inside.
Now generally available, Lookback automatically runs Huntress Unwanted Access detections across up to 180 days of available Microsoft 365 login history when an eligible tenant onboards to Managed ITDR. It helps you uncover earlier compromises, understand what you’ve inherited, and address active threats without waiting for an attacker’s next move.
What this means for you:
- Active compromises get a response: The Huntress SOC investigates, issues a critical Incident Report, and revokes active sessions.
- Previously remediated activity stays in context: Already-resolved compromises appear as historical findings, without triggering a new incident or unnecessary lockdown.
- Findings are easy to access and share: Lookback appears as a dedicated section of your Identity Security Assessment, delivered by email and available in the Huntress portal within 48 hours of onboarding.
Availability: Lookback runs once, automatically, for eligible Microsoft 365 tenants newly onboarded on or after October 19, 2026, including trial tenants.
There’s nothing extra to configure. Lookback is not available for GCC, GCC High, or CPV tenants.Whether you’re onboarding a new client or bringing your own organization onto Managed ITDR, Lookback gives you historical context and SOC-backed action from day one.
Read more in our new blog and check out our KB article.