Microsoft 365 Audit & Investigation Training USA

Microsoft 365 Audit & Investigation Training USA2023-09-18T16:45:34+01:00

Public Course Dates

No courses currently available

Prices exclude relevant taxes

If there are no available dates listed above, please register your interest and we will contact you once a date is available to book.

Course Overview

This Microsoft 365 Audit and Investigation training course will guide you through the Microsoft 365 environment tools that you will need to run an internal audit and investigation within your organisation. This course will give you the confidence to identify what information is being shared in your organisation and how to search for information inside your Microsoft 365 tenant. You will learn how to use the Investigation Analytics, Configuring Polices, Alerts and Triage experiences, Remediation and Litigation procedure.

What you will learn from the course:

  • To gain an understanding of the Audit functionality of Microsoft 365 
  • To gain an understanding of how the Audit functionality can be used for your organisation 
  • To gain an understanding of how to do a Basic Audit in Microsoft 365  
  • To understand how to interpret the audit logs to support investigations 
  • To gain an overview of the M365 platform 
  • Thinking about how audit investigations can be undertaken  

The course will cover the following topics:

  • Section 1 – Investigation Analytics

You will see how to use the scan function to quickly get an understanding of the insider risks an organization is exposed to, show suggested policies, and, see how to customize built-in policies as part of setup and deployment.

  • Section 2: Configuring Policies

You will use the Microsoft 365 compliance centre to create an insider risk policy for the data theft by departing employee use case. We will create policies to trigger events on specific risk activities we want to detect and investigate.

  • Section 3 – Alerts and Triage Experience

We will look at the steps involved to triage alerts, investigate to determine the actual event or issue, and drill down to determine validity by creating a case and preparing for remediation.

  • Section 4 – Remediation

We will look at available escalation paths such as inviting others, sending a notice, and escalating to Advanced eDiscovery. We will also take a quick look at Power Automate, Teams integration, and SIEM integration and see how easy it is to package up relevant details and send to others for review.

  • Section 5 – Litigation Procedure

We will look at connecting an investigation to litigation proceedings through an Advanced eDiscovery experience. We will take a look at how information collected through events will be packaged for investigations and packaging for submitting evidence for litigation events. E.g. Court proceedings.

Who should attend?

This course is for members of an Audit Team within the Police or anyone associated with a type of role that provides an audit function for internal investigations at all levels. The ideal delegate will be one who needs both a broad understanding of Microsoft 365 features, functions and security along with an in depth understating of Microsoft 365 audit features.

Suggested Follow on Courses

  • Microsoft 365 SharePoint Records Management
  • Microsoft 365 SharePoint Super User
  • Microsoft 365 Information Privacy & Protection
  • Microsoft 365 Teams Information Protection
  • Microsoft 365 Audit and Investigation
  • Microsoft 365 Syntex


Will I get a recognised qualification?2022-08-02T14:50:04+01:00

As part of our accreditation with the CPD accreditation group, you will receive either 6, 12 or 15 CPD points for each course attended depending on the course.

The Certificate in Managing Data Protection Compliance is a qualification and is the second qualification of a suite of 3 data protection qualifications.

Do you offer any course discounts?2022-08-02T14:47:26+01:00

Yes we offer a 10% discount for the primary delegate if you book more than one person from the same organisation at the same time.


What happens if the course is cancelled?2021-01-22T14:17:37+00:00

To try to avoid cancelling face to face courses, however if the number of delegates is below 5 we will offer this a virtual course instead.

See full terms and conditions.

When will I be advised of the venue location?2022-08-02T15:09:30+01:00

Exact location are sent out via email, two weeks before the course, we would therefore advise you not to book accommodation until the venue is confirmed.

Pre-Pay Option

Don’t know what courses you’ll need to book just yet? 

We offer a pre-pay option, where you can pay now and choose what courses to book later (within a year). This option is both cost efficient and speeds up the booking process. It’s really handy for large companies/organisations who have frequent training needs. 

Contact us for more information. 

In-House Training

If you’re looking to book training for 6 or more people onto the same course, we are able to offer private in-house training – a cost efficient option. 

Contact us for more information.

What our clients said about the course

The course was fantastic. Discussion between the attendees was useful, hands on aspects were great.

Head of Information Compliance

The hands on aspect of the course was essential to understanding the concepts. I really enjoyed playing the game during the course! such a great idea.

Planning Officer

Other courses you might like

Go to Top