Why the hell was a personal device allowed to login to anything work related for a police officer.
Give them dedicated devices for it. Enforce MFA, and implement some basic MDR.
We implement conditional access policies blocking any access outside of company owned devices for a lot less sensitive data.