Post #4163464
2026-07-28 12:20 UTC
Ray had some really good tips for Entra admins. We don’t need to become Purview experts but we do need to understand enough of the neighbouring products to ask better questions.
→ What triggered this policy?
→ Who should own the alert?
Replies (1)
-
@merill@infosec.exchange 2026-07-28 12:20
→ Should the response be a block, an investigation or simply some education? → And what will the user actually experience? Ray made a great point: the technical configuration may take 15 minutes, but getting all the right teams aligned is the real work.