A compliance investigator at a healthcare organization needs to determine which administrator accessed a specific patient's mailbox, when files were downloaded from SharePoint, and whether any user changed a retention policy over the past 90 days. Which Microsoft Purview capability should the investigator use to retrieve this record of user and administrator activities?