Auditing Admin activities in Microsoft Defender Endpoint | Microsoft Community Hub

https://techcommunity.microsoft.com/t5/public-sector-blog/auditing-admin-activities-in-microsoft-defender-endpoint/ba-p/4421154