Why are these alerts in Microsoft Purview and not in Microsoft Defender for Endpoint?

Hi all,

I'm hoping this might be an obvious thing that I'm missing, so apologies in advance for asking!

I regularly see alerts in Purview for a user creating a new/amending an email forwarding rule. I always follow up with them to confirm that this was them, even if it's internal.

I tried to firm up my knowledge around what to do in Defender if one of these rules did turn out to be malicious, but all of the guidance relates to these alerts being in Defender.

However, the alerts I see are always in Purview and never in Defender. Why is that?

• Where is Purview pulling this data from?
• Why is Defender not pulling this data down and alerting?
• Should it be?
• And how do I turn on the data stream/create alerts for this activity?

I tried some of the KQL queries in advanced hunting, and Defender can find the activity, it's just not alerting.

Also, when I was researching (last week), under the Defender 'Explorer' tab there was a cog settings wheel that showed that the Microsoft Defender for Endpoint connection was switched off. When I checked today, it's not there! How do I check whether the this connection is enabled, and if not, where and how do I enable it?!?