If you know of a specific phishing email that may have compromised your account, you can search the system to see if others were sent the same email. If copies are found, you can check with those accounts for unusual activity shortly after receiving the phishing email. Suppose you don’t know of a specific email, but have evidence of unusual activity or a report of an issue with users. There, you can check for unusual activity across the enterprise. Common things to look for are IP addresses outside of “normal” for your environment, such as IP addresses outside your geographic location, especially if you rarely have traveling employees or employees outside your country or region. Other unusual activities may include off-hours activity, attempts to login in rapid succession, or logins from two disparate locations (e.g., opposite coasts minutes apart for the same user). Setting up audits or alerts can help catch concerns as they happen. Microsoft Office 365 has options that can notify you of security issues. It also has extensive resources to assist you in configuring your system to provide needed monitors and alerts.