Three ways to total the GB of SharePoint files not modified in 2, 3 or 5 years: Purview content search, a PnP PowerShell script and SharePoint Storage Explorer.
What SharePoint Advanced Management includes, which licences unlock it, whether Copilot covers it, and what it does and does not do about SharePoint storage.
Impossible travel and new-country sign-in alerts are famously noisy. The reasons why, the difference between the Entra ID and SharePoint signals, and what separates a real account takeover from proxy egress.
Email archiving means four different jobs, and buying the wrong one is common. Compliance journaling, in-place archives, departed-user archiving and backup compared, with what to check before you buy.
A reference mapping MITRE ATT&CK techniques to the SharePoint, OneDrive and Entra ID audit events that actually evidence them, with the detection signal for each.
Much of what the Microsoft 365 audit log records as user activity is the platform itself. Twelve patterns that look like exfiltration, password spray or privilege escalation, and what each one really is.
Hundreds of files vanished from SharePoint. How to tell ransomware or a wipe from a user re-filing a folder, using the signals in the audit log that actually separate them.
Microsoft forces unlicensed OneDrive accounts read-only at 60 days, archives them at 93, and deletes at 365 unpaid days. The timeline, the fees, and how to avoid it.
How to recover deleted OneDrive files: the recycle bin, the 93-day window, restoring your whole OneDrive, and how admins get back a departed user's files.