Microsoft 365 Audit & Investigation Training Australia

Course Overview

This Microsoft 365 Audit and Investigation training course will guide you through the Microsoft 365 environment tools that you will need to run an internal audit and investigation within your organisation. This course will give you the confidence to identify what information is being shared in your organisation and how to search for information inside your Microsoft 365 tenant. You will learn how to use the Investigation Analytics, Configuring Polices, Alerts and Triage experiences, Remediation and Litigation procedure.

What you will learn from the course:

• To gain an understanding of the Audit functionality of Microsoft 365 
• To gain an understanding of how the Audit functionality can be used for your organisation 
• To gain an understanding of how to do a Basic Audit in Microsoft 365  
• To understand how to interpret the audit logs to support investigations 
• To gain an overview of the M365 platform 
• Thinking about how audit investigations can be undertaken  

The course will cover the following topics:

• Section 1 – Investigation Analytics

You will see how to use the scan function to quickly get an understanding of the insider risks an organization is exposed to, show suggested policies, and, see how to customize built-in policies as part of setup and deployment.

• Section 2: Configuring Policies

You will use the Microsoft 365 compliance centre to create an insider risk policy for the data theft by departing employee use case. We will create policies to trigger events on specific risk activities we want to detect and investigate.

• Section 3 – Alerts and Triage Experience

We will look at the steps involved to triage alerts, investigate to determine the actual event or issue, and drill down to determine validity by creating a case and preparing for remediation.

• Section 4 – Remediation

We will look at available escalation paths such as inviting others, sending a notice, and escalating to Advanced eDiscovery. We will also take a quick look at Power Automate, Teams integration, and SIEM integration and see how easy it is to package up relevant details and send to others for review.

• Section 5 – Litigation Procedure

We will look at connecting an investigation to litigation proceedings through an Advanced eDiscovery experience. We will take a look at how information collected through events will be packaged for investigations and packaging for submitting evidence for litigation events. E.g. Court proceedings.