Microsoft 365 Certified: Administrator ExpertDeploy and manage a Microsoft 365 tenantEasy
A company is implementing Microsoft 365 and needs to ensure that all administrative actions performed by global administrators, user administrators, and Exchange administrators are logged and available for auditing for at least one year. Which Microsoft 365 feature should the administrator configure to meet this requirement?
- AMicrosoft Defender for Cloud Apps activity logs
- BMicrosoft 365 Unified Audit Log
- CExchange Online Message Trace
- DAzure Active Directory Sign-in Logs
Show answer & explanationAnswer & explanation
Correct answer: B. Microsoft 365 Unified Audit Log
The Microsoft 365 Unified Audit Log records administrative activities and user actions across various Microsoft 365 services, including Azure AD, Exchange Online, and SharePoint Online, and retains them for a specified period, meeting the auditing requirements.
Why the other options are wrong
- A. Microsoft Defender for Cloud Apps activity logs focus on app usage and data access, not general Microsoft 365 administrative actions.
- C. Exchange Online Message Trace tracks email flow, not administrative actions.
- D. Azure Active Directory Sign-in Logs only record user sign-in activities, not administrative actions across the suite.
Microsoft 365 Unified Audit Log
A comprehensive logging service in Microsoft 365 that captures user and administrator activity across various services, providing a single source for auditing and forensic investigations.
- Records activities across Exchange, SharePoint, Teams, Azure AD, etc.
- Retains logs for a configurable period (up to 10 years with E5).
- Searchable through the Microsoft Purview compliance portal.
Memory trick: The Unified Audit Log is your detective's notebook, recording every admin move across Microsoft 365.