Question

During an incident investigation in Microsoft Defender XDR, you confirm a user account was compromised for approximately 6 hours before being disabled. Leadership asks you to determine exactly which SharePoint and OneDrive files the attacker viewed or downloaded during that window, including the specific file names and client IP addresses. Your organization has a Microsoft 365 E5 license. Which tool should you use to obtain this evidence?

Accepted Answer

Run a Purview Audit (Standard/Premium) search filtered for FileAccessed and FileDownloaded activities scoped to the user and the compromised time window

Answer

Create an eDiscovery (Premium) case and place the user's SharePoint and OneDrive sites on legal hold

Answer

Query the Microsoft Graph activity logs to enumerate the Graph API calls made by registered applications

Answer

Use Defender for Endpoint live response to collect an investigation package from the user's device