Microsoft Purview: Data Security Investigations – analyze files tied to audit log activities

Speed up analysis of exfiltrated content by launching Data Security Investigations (DSI) from Unified Audit Log activity. In DSI, build your audit log query by specifying criteria such as time range, activities, users, and keywords. DSI then automatically pulls the associated files into the investigation (for example, UserA downloaded a file on 3/1/2026).

Added to roadmap: 12 mrt 2026 | Last modified: 4 mei 2026

What changed in Microsoft 365 this week? →