You have a Microsoft 365 E5 subscription. You plan to use insider risk management to collect and investigate forensic evidence. You need to enable forensic evidence capturing. What should you do…

The information protection scanner is used to discover and classify sensitive data in on-premises file repositories and is entirely unrelated to enabling forensic evidence capturing in Insider Risk Management.

Forensic evidence capturing in Insider Risk Management requires dedicated organizational storage capacity that must be explicitly claimed in the Microsoft Purview settings before the feature can be enabled or policies configured. Claiming capacity allocates the resources needed to store captured screen activity and recordings. Without completing this step, the forensic evidence configuration options in policy setup remain locked and inaccessible.

Adaptive Protection adjusts DLP enforcement dynamically based on a user's insider risk level and is a separate feature that is not a prerequisite for forensic evidence configuration.

Creating priority user groups designates specific users for heightened monitoring within risk policies but is not a prerequisite step required before forensic evidence capturing can be enabled.