Your organization is leveraging Microsoft 365 and has recently identified a potential insider threat. The security team is tasked with investigating and mitigating this threat effectively. The organization operates in a highly regulated industry, requiring strict compliance with data protection laws. Additionally, the solution must minimize operational disruption and ensure scalability to handle potential future incidents. Given these constraints, which of the following steps should be prioritized to address the insider threat comprehensively? (Choose the best single option)