Learn how to quickly identify all actions taken by an attacker within an account after a compromise.
The Incidents page, here for a single tenant.
The Incident page (Remediation Actions Panel hidden)
The Timeline (in 'Full' view).
The 'Overview' tab of the Excel export.
The 'Logins' tab of the Excel export.
The Activity viewer, with a malicious app registration tagged.
The Remediation Actions Panel, with a malicious app registration tagged (already removed).