Forensic evidence capturing in Microsoft Purview Insider Risk Management is an add-on feature that requires specific licensing capacity. After purchasing the add-on, the first administrative action required to activate the feature is to claim this capacity within the Microsoft Purview compliance portal. This step makes the forensic evidence functionality available for configuration within your tenant. Without claiming the capacity, the settings to enable and configure forensic evidence capturing for user devices will not be accessible, making it the necessary initial step.

A. The information protection scanner discovers and classifies sensitive data on-premises; it is not a prerequisite for enabling the device-based forensic evidence feature.
C. Adaptive Protection is a feature that dynamically adjusts Data Loss Prevention (DLP) policies based on user risk levels, not a requirement for forensic evidence.
D. Creating priority user groups is a step for targeting insider risk policies, which is performed after the core features, like forensic evidence, are enabled.

1. Microsoft. (n.d.). Learn about forensic evidence for insider risk management. Microsoft Learn.

Reference Point: In the "Prerequisites" section, the documentation explicitly states, "If you've purchased forensic evidence add-on capacity, you must first claim your capacity in the Microsoft Purview compliance portal." The subsequent section, "Claim your capacity," details this as the initial configuration step.

2. Microsoft. (n.d.). Get started with insider risk management. Microsoft Learn.

Reference Point: Under the "Deployment" heading, "Step 2: Enable permissions and forensic evidence (if needed)" outlines the initial setup tasks. It confirms that enabling forensic evidence is a distinct, early step in the configuration process, which involves meeting prerequisites like licensing and claiming capacity.