large amounts of data downloaded are monitored

Question

I am in the middle of an audit of Power BI and a couple of questions I was hoping you could help me with. To give you some background, I work for a large enterprise that has over 700 workspaces with over 10 gateways, etc.

One of the controls that I was assigned is listed below:

• Validate if a monitoring process is in place for data access changes and if large amounts of data downloaded are monitored.

Is there any standard/baseline/metric, etc. that would be large amounts of data being downloaded by a User/Member of a Workspace and/or a “consumer” of dashboards/reports that have been published?

Also, would this activity be captured on the M365 Unified Audit Logs? And if so, what “activity” would to have included on the logs? There are approximately 120 operations available in the audit and audit logs (source: Track user activities in Power BI - Power BI | Microsoft Learn)

The Power BI Admin went to the Admin Portal to generate the logs. I was told the file was so huge, that I need to select which operations from the list of 120. Is there an operation on that list that would indicate excessive amounts of data downloading occurring by a user or consumer? Would it be “Downloaded Power Bi Report” and then look return the logs for a user that’s doing this a lot?

I am at a lost on how to test this. Users of Workspaces are doing data downloaded from gateways all the time from MS Azure sharepoint sites, applications, etc. So how could you define excessive or large amounts of data being downloaded. That’s why people use Power Bi😊.

Any suggestions?