Microsoft 365 FundamentalsDescribe security, compliance, privacy, and trust in Microsoft 365Medium
A Microsoft 365 global administrator is investigating a security incident where a user's account was compromised. The administrator needs to review all activities performed by that user over the past 30 days, including file access, email sends, and administrative changes. Which Microsoft 365 compliance capability provides a detailed record of these user and admin activities?
- AMicrosoft Purview Communication Compliance
- BMicrosoft Purview Audit (Standard/Premium)
- CMicrosoft Purview Records Management
- DMicrosoft Purview Data Lifecycle Management
Show answer & explanationAnswer & explanation
Correct answer: B. Microsoft Purview Audit (Standard/Premium)
Microsoft Purview Audit (Standard/Premium) provides a comprehensive record of user and administrator activities across Microsoft 365 services, enabling detailed investigations into security incidents, compliance breaches, and forensic analysis.
Why the other options are wrong
- A. Communication Compliance helps detect and remediate inappropriate communications, not log all user activities for security investigations.
- C. Records Management focuses on managing the lifecycle of records for legal and regulatory compliance, not detailed activity logging for security incidents.
- D. Data Lifecycle Management focuses on retention and deletion policies for data, not on auditing individual user actions.
Microsoft Purview Audit
A compliance solution in Microsoft 365 that captures and logs user and administrator activities across various Microsoft 365 services, enabling forensic investigations, security monitoring, and regulatory compliance.
- Provides a searchable log of activities.
- Supports both standard and premium logging levels.
- Crucial for security investigations and compliance audits.
Memory trick: Audit logs are like security cameras, recording every action to review later.