A 311 resident-services desk receives a suspicious file shared in Teams and wants an investigation path aligned to Microsoft Defender XDR concepts. What should they emphasize?

A suspicious file shared in Teams at a 311 resident-services desk should be investigated using Microsoft Defender XDR cross-signal protection and investigation ideas. Teams content is inside Microsoft 365 security scope: the file may link to email delivery, identity risk, or endpoint execution. Emphasizing Defender XDR-style investigation keeps municipal 311 response aligned with correlated threat protection rather than assuming chat apps are somehow exempt.

Correlating the suspicious Teams file using Defender XDR Endpoint device timeline alert investigation fails because it limits the investigation to endpoint signals; Defender XDR requires cross-signal correlation across email, identity, and cloud apps rather than a single device timeline check. Analyzing the suspicious Teams file using Defender XDR Identity compromised account signal review fails because it isolates the inquiry to identity risk; the file itself demands a cross-signal Defender XDR review, not just compromised account signals. Examining the suspicious Teams file using Defender XDR Cloud Apps collaboration session investigation fails because it confines the response to Cloud Apps session details; the scenario calls for immediate cross-signal Defender XDR investigation, not a single collaboration session investigation.

Exam caveat: AB-900 asks you to map the scenario to Defender XDR's cross-signal approach, not to execute every remediation playbook step. Containment may include restricting the file, but the tested idea is investigation under XDR concepts. Do not treat permission sprawl as malware analysis.

Operational check: Isolate or restrict the suspicious Teams file per policy, open related Defender signals (email, identity, device) for the involved 311 users, avoid granting blanket Owner rights for "inspection," and restore sharing only after clearance. Confirm staff know how to report suspicious Teams content without disabling file sharing tenant-wide as the default response.