What SharePoint Advanced Management includes, which licences unlock it, whether Copilot covers it, and what it does and does not do about SharePoint storage.
Impossible travel and new-country sign-in alerts are famously noisy. The reasons why, the difference between the Entra ID and SharePoint signals, and what separates a real account takeover from proxy egress.
Email archiving means four different jobs, and buying the wrong one is common. Compliance journaling, in-place archives, departed-user archiving and backup compared, with what to check before you buy.
A reference mapping MITRE ATT&CK techniques to the SharePoint, OneDrive and Entra ID audit events that actually evidence them, with the detection signal for each.
Much of what the Microsoft 365 audit log records as user activity is the platform itself. Twelve patterns that look like exfiltration, password spray or privilege escalation, and what each one really is.
Hundreds of files vanished from SharePoint. How to tell ransomware or a wipe from a user re-filing a folder, using the signals in the audit log that actually separate them.
Microsoft forces unlicensed OneDrive accounts read-only at 60 days, archives them at 93, and deletes at 365 unpaid days. The timeline, the fees, and how to avoid it.
How to recover deleted OneDrive files: the recycle bin, the 93-day window, restoring your whole OneDrive, and how admins get back a departed user's files.
How to export a Microsoft Teams chat - manual options, Purview eDiscovery for admins, what happens after a user leaves the organization, and why retention is not export.
A practical guide to reducing SharePoint Online storage - trim version history, empty the recycle bins, clear the Preservation Hold Library, find your largest sites, and archive inactive content to cut the $0.20/GB overage bill.