Forum Discussion
Microsoft Defender for Endpoint Audit Logs
Is there a way to check who created the Microsoft Defender for Endpoint instance in the first place and set up the Data Storage option. may we can run some queries to get the activity logs on...
I don't recall seeing this info either in the Azure AD Audit Logs or the Microsoft 365 Audit Logs, so my guess would be that this is not an event that can be seen by normal admins. Microsoft has more audit logging in their backend, so if it's not in the usual places, perhaps this is something Microsoft support can help you with.