Microsoft Purview Insider Risk Management forensic evidence add-on is an opt-in, capacity add-on feature in Microsoft Purview Insider Risk Management that gives security teams visual insights into potential insider data security incidents, with user privacy built in. Organizations can purchase the add-on in units of 100GB per month. Purchased capacity applies to the ingestion of forensic evidence beginning on the date of purchase and resets on the first of the month. Unused capacity does not carry over. We recommend you purchase the license at the beginning of the month to maximize the value of the license. Learn more at: https://aka.ms/ForensicEvidenceSKU