In a Microsoft 365 E5 subscription with a hybrid Azure AD environment , monitoring changes to privileged Active Directory groups (like Domain Admins ) is handled by Microsoft Defender for Identity .
The "Modifications of sensitive groups" report provides visibility into all changes made to sensitive AD groups such as Domain Admins , Enterprise Admins , and Schema Admins .
According to Microsoft Defender for Identity documentation:
"The Modifications of sensitive groups report identifies all changes to highly privileged groups, including additions and removals of members. It helps detect potential privilege escalation and insider threats." This report displays all relevant group modification activities within a defined time range (for example, the last 30 days), fulfilling the requirement.
# Correct answer: C. the Modifications of sensitive groups report in Microsoft Defender for Identity