A SaaS provider holds the only record of what a third-party OAuth app read from your tenant - how do you acquire it?

## Evidence you cannot collect Everything else in acquisition assumes you can reach the source: you have the host, the disk, the agent. When the material lives inside a provider's platform - which identity consumed a delegated permission, what a service principal enumerated, which records a connector touched - you have no such reach. Your tenant's own console shows you what your licence tier exposes and retains, which is routinely a fraction of what the provider itself holds and for a shorter period. The remainder is acquired by **request**, and a request has properties an image does not: latency you do not control, a scope fixed at the moment you file, a format chosen by someone else, and a counterparty who may say no. ## Step one, and it is genuinely first: preservation Before you argue about scope, stop the clock. A preservation or legal-hold request tells the provider to retain records relating to a defined tenant, principal and period beyond its normal deletion schedule. It is cheap, it is fast, and it is the only step that is irreversible if skipped - retention that expires while you are drafting a careful request is gone, and no amount of later escalation recovers it. Send it in writing, through the channel the contract names (enterprise support, a named TAM, the security contact, or counsel-to-counsel where the agreement requires it), and keep the acknowledgement. Scope the hold wider than you think you need; narrowing later is free, widening later may be impossible. ## Step two: a request that is precise where it must be and generous where it can be A provider will act on an identifiable request and stall on a vague one. Name: - the **tenant or account identifier**, - the **subject**: the application or service principal identifier, and the grant in question, - the **record types** you want, in the provider's own vocabulary - use their documentation's terms, not yours, - the **time window**, deliberately wider than your current hypothesis, because the discovery date is not the compromise date and re-filing costs weeks, - the **format and delivery** you can actually ingest, and a request for a statement of what the export does and does not cover. Ask explicitly whether records exist that your tier does not surface, and whether anything requires legal process rather than a support request. That answer shapes the timeline more than anything else you do. ## Step three: treat receipt as acquisition An export is evidence you did not collect, which makes documentation more important, not less. Record: - who filed the request, when, and its exact text or reference, - the provider's acknowledgement and any scope negotiation, - when the export arrived, through what channel, and its hash on receipt, - the provider's own description of coverage and any caveats it attached. You cannot demonstrate the provider's internal collection integrity, and you should not claim to. What you can demonstrate is an unbroken account from request to receipt to analysis, and that the copy you analysed is identical to the one delivered. ## Reading it: what the export actually proves This is where cases go wrong. A provider export proves **what the provider recorded**. It does not prove what happened. - An entry showing a token issued to a service principal proves a credential was accepted for that principal, not that a person was at a keyboard. - An entry showing an API call proves the platform logged the call, not the contents of what came back. - **The absence of an entry proves nothing on its own.** The record type may not be generated at your licence tier, may not be part of the export the provider chose to run, or may fall outside the window you asked for. Distinguishing *not recorded* from *did not happen* is the single most valuable thing you can do with an export, and the honest answer is often that the data cannot settle the question. ## The waiting problem Provider turnaround runs from days to weeks; legal process runs longer. The investigation cannot stall for it, and this is what separates a senior answer from a procedural one: you file the preservation request within the first hour, file the export request as soon as scope is defensible, and then run every line of enquiry you *do* control in parallel - the endpoint sweep, your own retained tenant telemetry, the identity provider's records you already hold. You also tell the incident lead the export's expected arrival, because a finding that lands in three weeks changes what the interim conclusions can safely say. ## When the answer comes back thin Providers sometimes deliver less than asked, or a normalised summary rather than the underlying records. Push back once, in writing, naming what is missing and why it matters; escalate through commercial ownership rather than support if the contract has teeth; and if the record simply does not exist, write that down. `The provider does not retain this` is a finding about your own visibility, and it belongs in the retrospective as a gap to close before the next incident - which is a better outcome than a report that quietly implies coverage you never had.