I've built systems which required "helpdesk" type access and had auditing, but the problem is where do think "audit summary report" is on the TODO pile for the people getting those summaries? I'm guessing it's between "Delete unread" and "I really ought to get around to it but I'm too busy so I never do".
Even when it comes to third party audit, those are ring binder driven processes. Does the audit report get generated? Yes, check. Does the person it goes to have a requirement to check it? Yes, check. Done, pass. Auditors _might_ ask to see an example report, but they definitely aren't going to add bogus entries to see what happens for example.
Spot checks aren't a thing in almost any industry. "Chaos Monkey" style checks aren't a thing anywhere at all. So it's easily possible that for six months (or three months) Microsoft was generating internal reports that said "Bob the Helpdesk worker has accessed ten times more user emails today than anybody else" and nobody was asking "Wait, why is Bob an outlier?".
With a targeted attack like this one, your suggestion about requiring a ticket doesn't help very much, the attacker is motivated to jump through hoops unlike script kiddies looking for low-hanging fruit. Insider fraud at banks has been known to go as far as a fake "customer" phoning up to authorize the steps that the bad guys want to take, so that there's an authorization on record when they do them and it won't immediately be flagged as a problem. The real customer may later convince a court that it wasn't them, but that's not real time, the insiders are long gone and so is the money.
Now, you can build systems where it's just impossible for even your own people to get access. But that has a high cost, as you will see in every thread where people castigate Google because they got locked out of something. Why can't Google just hire helpdesk people who have super-user access, they ask...
Even when it comes to third party audit, those are ring binder driven processes. Does the audit report get generated? Yes, check. Does the person it goes to have a requirement to check it? Yes, check. Done, pass. Auditors _might_ ask to see an example report, but they definitely aren't going to add bogus entries to see what happens for example.
Spot checks aren't a thing in almost any industry. "Chaos Monkey" style checks aren't a thing anywhere at all. So it's easily possible that for six months (or three months) Microsoft was generating internal reports that said "Bob the Helpdesk worker has accessed ten times more user emails today than anybody else" and nobody was asking "Wait, why is Bob an outlier?".
With a targeted attack like this one, your suggestion about requiring a ticket doesn't help very much, the attacker is motivated to jump through hoops unlike script kiddies looking for low-hanging fruit. Insider fraud at banks has been known to go as far as a fake "customer" phoning up to authorize the steps that the bad guys want to take, so that there's an authorization on record when they do them and it won't immediately be flagged as a problem. The real customer may later convince a court that it wasn't them, but that's not real time, the insiders are long gone and so is the money.
Now, you can build systems where it's just impossible for even your own people to get access. But that has a high cost, as you will see in every thread where people castigate Google because they got locked out of something. Why can't Google just hire helpdesk people who have super-user access, they ask...