During an insider-threat incident in Microsoft Defender XDR, a Sentinel-correlated alert shows a departing sales manager mass-downloading customer contracts before their resignation date. Legal notifies the SOC that this data may be subject to upcoming litigation and instructs you to ensure the user's mailbox and OneDrive content cannot be altered or purged while the investigation proceeds. Which Microsoft Purview eDiscovery action should you take first to meet the legal preservation requirement?