Turn suspicious Microsoft 365 sign-ins into a 24-hour attack timeline. Correlate Entra ID, mailbox and endpoint evidence for confident containment…