From findings to action Mitigation in Data Security Investigations. Findings from the examination go to the mitigation list, which can be shared with other teams. The phishing email is added to the purge queue, and a purge permanently deletes the matched items from Exchange or Teams. Purge does not cover SharePoint or OneDrive, holds still apply, and mail sent outside the organization cannot be recalled. The Activities tab keeps the history and a report for each purge. When the case is closed, keep the evidence and delete the investigation. W INVESTIGATION AND RESPONSE From findings to action Ada Admin Eli Employee FROM FINDINGS TO ACTION What we know, and what to do about it THE AUDIT LOGSign-in at 07:06, inbox rule at 07:13, mail read, a false invoice sent at 09:40. DATA SECURITY INVESTIGATIONSA customer list with personal data was in the mailbox the attacker controlled. These findings are the basis for the notification decision,and for the actions in this video. BEFORE YOU PURGE What purge can, and cannot, do CLOSE THE CASE Keep the evidence, delete the investigation Microsoft Purview ← Back Examination results Threats and mitigation ⤓ Export+ Add to mitigation0 of 57 selected Subject/TitleRisk scoreRisk summaryMitigation steps Add to mitigation listAdd to purge queue ✓ 2 items added to the mitigation list Investigations › Eli Employee - Breached mailbox investigation Eli Employee - Breached mailbox investigationSummaryAnalysisMitigationActivities Explore insightsCategorizeExamine+ Add to mitigation2732 items Subject/TitleSender/AuthorRecipientDate (UTC) Add to mitigation listAdd to purge queue Add to purge queue Name AddCancel Investigations › Eli Employee - Breached mailbox investigation Eli Employee - Breached mailbox investigationSummaryAnalysisMitigationActivities Mitigation listPurge queue ⤓ Download list↻ Refresh Status: AnyAdded by: AnyAdded date (UTC): Any NameStatusTypeAdded byAdded date NameStatusActionAdded byAdded date Phishing email for purgeNot startedPurgeAda AdminOct 18, 2026 Phishing email for purge ActionPurge scopeStatusNot started Added date (UTC)Oct 18, 2026 10:52 AM Purge queryData sources:Eli EmployeeQuery:subject:"Your mailbox will be suspended" RunRemove from queue Purge items matched to 'Phishing email for purge' You're about to permanently delete matched items from their original datasources. This action can't be undone. Once purged, the search query can't be edited. CancelPermanently delete Investigations › Eli Employee - Breached mailbox investigation Eli Employee - Breached mailbox investigationSummaryAnalysisMitigationActivities ActivityStatusStarted byStarted (UTC)Report Good to know 1/7 INVESTIGATION AND RESPONSE From findings to action We turn the findings into actions: a mitigation list for other teams, a purge of the phishing email, a report from Activities, and closing the case without losing the evidence. informasjonsbeskyttelse.no