Security wants longer-term analysis of supported Entra activity in a Log Analytics workspace using KQL. What should be configured?

1. A user display-name convention only
2. A resource lock on the tenant's billing page
3. Diagnostic settings routing the required activity categories to the workspace
4. A private DNS CNAME for every user