if you use a full 0365 stack there are a lot more datapoints to use than just emails sent, or documents opened/created. you have login times to see if they are

if you use a full 0365 stack there are a lot more datapoints to use than just emails sent, or documents opened/created. you have login times to see if they are late, chat metadata to see time to response on dm, idle status to see if keyboard / mouse went inactive. meetings attended, page views on the intranet, etc. if your a full stack o365 shop, then you can essentially log any and all activity for most employees, and therefore target kpi's that you want. even it admins to a degree will have these logged. powershell sessions opened, commands executed against the stack, every single click 8n the web gui in o365, every single action in azure. they are all logged and assessable, I used the same data for security monitoring before I moved to a Google shop