You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1. WS1 has the Azure Activity connector and the Microsoft Entra ID connector configured. You need to investigate…

You cannot 'use' UEBA to detect anomalies until it has been enabled and configured, making enabling it the prerequisite first action.

Enabling User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel is the foundational step to enrich user and entity data, enabling the system to automatically correlate activities and provide insights into anomalous behavior, which is essential for investigating accounts with the most alerts and associated incidents.

Installing Microsoft Purview insider risk management is primarily for managing insider risks within Microsoft 365 and does not directly enhance Sentinel's core capabilities for investigating general account-based alerts and incidents.

While 'Cloud Identity Threat Protection Essentials' may offer useful content, enabling UEBA is a more fundamental and direct step for gaining behavioral insights into accounts and alerts from the existing connectors.