How can I detect someone enabling Forensic Evidence Capturing?
Someone recently drew my attention to Microsoft Purview's Forensic Evidence Capturing feature under insider risk management-- powerful stuff! But also a feature I would only want to see turned on if duly authorized. How can I detect someone enabling this in Microsoft Sentinel? I tried enabling/disabling it but do not see any events referencing "forensic evidence" generated anywhere.
Turn on O365 alerting when Admin role is activated?
Hi all 🙂 I am wondering how I turn on alerts when a role is activated through O365 rather than Azure AD. I have PIM setup for Azure AD, but when an Admin role is assigned/activated through the O365 portal, then I do not receive an alert. Any and all help is appreciated 🙂
