Enable all auditable events
You likely aren’t collecting all available events to the Unified Audit Log :( First, not all events are enabled or retained optimally. Consider creating this policy in the Purview portal (lea...
Search for Microsoft security blog posts written and shared by the community.