It would be great it the "Users flagged for risk" reports/events would support extended workflow capabilities (e.g. like the action workflows in Windows Defender Security Center):

• Ability to assign an event so that other AD admins can see if/who is taking care


• Ability to comment on an event (e.g. during resolution or as a final closure comment)


• History of all actions on an event including timestamps and user information of who did what