Microsoft 365 FundamentalsDescribe core Microsoft 365 services and conceptsHard
A Microsoft 365 administrator is auditing user activity to ensure compliance with internal policies. They need to retrieve detailed logs of specific actions performed by users, such as who accessed a particular document, when it was modified, and from where. Which Microsoft 365 capability provides this granular auditing information?
- AMicrosoft Search
- BMicrosoft Purview Audit
- CMicrosoft Graph
- DMicrosoft Defender XDR
Show answer & explanationAnswer & explanation
Correct answer: B. Microsoft Purview Audit
Microsoft Purview Audit (Standard and Premium) provides comprehensive logging of user and admin activities across Microsoft 365 services. It allows administrators to search and retrieve detailed audit records, which is crucial for compliance, forensic investigations, and understanding user behavior.
Why the other options are wrong
- A. Microsoft Search is for finding content across Microsoft 365, not for auditing user actions.
- C. Microsoft Graph is a developer API for accessing data across Microsoft 365, not an end-user auditing tool.
- D. Microsoft Defender XDR is for extended detection and response across endpoints, identities, email, and cloud apps, focusing on security threats, not general user activity auditing for compliance.
Microsoft Purview Audit
A Microsoft 365 compliance solution that logs user and admin activities for forensic investigations, compliance, and regulatory requirements.
- Records activities across Exchange, SharePoint, OneDrive, Teams, Azure AD, etc.
- Audit Standard provides basic retention; Audit Premium offers longer retention and advanced capabilities
- Searchable through the Microsoft Purview compliance portal
- Essential for eDiscovery and understanding user behavior
Memory trick: To 'audit' activities, use 'Purview Audit' for detailed logs.