User was scammed out of thousands of dollars

Pretty much the only thing you can do is audit logs. I thought they should go back 90 days, but when did this money exchange occur? You can use portal.azure.com and there is some base security features in there that will usually detect suspicious login activity such as logging in form another country which usually triggers this issue, but at times you will have these phishers VPN locally to bypass this.

Ideally you want your users to use MFA to prevent this sort of attack, we've had them trying it in our org previously often via phishin e-mails is usually how they get in, they read their e-mails then start their attacks. Since we finally got everyone on MFA haven't heard nor seen a peep.

Anyway, portal and audit logs should show a pretty obvious "other IP" logging into the account than the normal IP's on the account. One other audit log entry to search for that is common is searching for "inbox rule creation", almost everytime these guys hack into someone's e-mail they will setup an auto delete rule or something to move messages from their targets so they don't get suspicious so checking their mailbox rules might give a clue as well, and the audit log used to show these events and you can time stamp or narrow down when they were created.

Anyway, hope some of this helps.