Audit Email Preview-Download action
This query helps report on who Previewed/Downloaded email messages using the Email entity page in Defender for Office 365
Microsoft Sentinel (KQL)

This query helps report on who Previewed/Downloaded email messages using the Email entity page in Defender for Office 365

Already have an account?