Hello,
I'm in the process of creating a design doc for MDI for a customer and one of the security requirements is that admins should not be able to delete their own activity in the product. I've noticed that there doesn't seem to be a way to delete Incidents/Alerts in the Defender 365 portal but you can delete alerts in the older ATP Portal.
Is it possible to prevent deletions in the AATP portal or at least log it through Conditional Access Policies or something else in Azure??
Kind regards,
Rob
