Phase 5: Monitoring and response

Goal: see every interaction, keep the evidence, and act on risk.

📄️Audit and Retention

CopilotInteraction records, record type 261, the 180-day retention trap, and eDiscovery.

Posture, reports, activity explorer, the one-click policies and what they miss.

The Risky AI usage template, scoring, and the Conditional Access insider-risk condition.

Ingestion paths, the Management Activity API build, and hunting queries.