Responders need to investigate access to sensitive Microsoft 365 files. Which approach is appropriate?

1. Grant every responder global administrator permanently
2. Query relevant audit activity using an authorized role and correlate identities, files, and timestamps
3. Use endpoint CPU metrics as the sole access record
4. Assume a sensitive label proves that nobody accessed the file