An administrator suspects unusual sign-ins by a user and needs event evidence before deciding the scope of containment. Which approach best fits?

1. Review relevant login and security audit events.
2. Apply the service's supported group or organizational-unit access policy.
3. Configure the SAML application, user assignment, and identity mapping.
4. Use the security center's applicable health and investigation capabilities.