The Ninety Days Before the Resignation

The resignation letter was two sentences long. The company's sales director gave notice on a Friday, thanked the organization for the opportunity, and began working for a direct competitor eleven days later. At first, the departure appeared routine. Then, within a month, the company's two largest accounts received proposals from the competitor that looked strikingly familiar. The proposals followed the same structure, used a similar pricing approach, and appeared to reflect detailed knowledge of the company's account strategies, sales methods, and confidential client information. Leadership suspected that its playbook had walked out the door with the former executive. Suspecting it was one thing. Proving it was another.

The evidence, if it existed, was buried inside the company's Microsoft 365 activity records. During the ninety days before the resignation, the director's account generated more than 40,000 individual activity events. Almost all of them appeared routine. A sales director regularly accesses pricing models, client files, account plans, presentations, and prospect information. The question was not simply whether he had accessed sensitive information — accessing that information was part of his job. The real question was whether his behavior had changed, and whether the timing and pattern of that change showed that confidential information had been removed before his departure.

BlueStar applied its Microsoft 365 Employee Activity Analysis workflow to the exported audit and sign-in data. Before evaluating the final ninety days, BlueStar established a behavioral baseline for the director: his typical working hours, normal volume of file access and downloads, devices he routinely used, locations from which he normally connected, and his activity during comparable periods over the prior two years. This baseline gave the investigation something essential: a defensible picture of what ordinary activity looked like for this specific employee.

Approximately six weeks before the resignation, the director's download activity began to increase. On a Tuesday evening, files were downloaded in bulk from OneDrive and SharePoint outside the director's normal working hours. Within an hour, related materials were sent externally to a personal webmail account associated with the director. Over approximately three weeks, BlueStar identified five separate episodes: sensitive files accessed or downloaded in unusual volumes, activity occurring outside established working patterns, documents transferred shortly after they were accessed, and two episodes involving a device that had never previously appeared in the director's sign-in history.

The documents involved were not random. They included confidential pricing models, account strategy documents, competitive positioning materials, the company's master prospect list, and information concerning the two clients who later received proposals from the competitor. Armed with the timeline, counsel issued a preservation demand and cease-and-desist letter within a week. The former executive was confronted not with a general accusation, but with specific dates, file names, download activity, transfer sequences, device information, and the personal email address to which company materials had been sent. The matter resolved before a complaint was filed — the company obtained the return of its confidential files, sworn certifications that copies had been deleted, and withdrawal of the competitor's proposals to the affected clients.