Microsoft 365 FundamentalsDescribe security, compliance, privacy, and trust in Microsoft 365Medium
A Microsoft 365 administrator is tasked with ensuring that all administrative actions performed within the Microsoft 365 tenant are logged and discoverable for security and compliance audits. This includes changes to user accounts, service settings, and data access. Which Microsoft 365 capability provides a unified log of these activities?
- AAzure AD Sign-in Logs
- BMicrosoft 365 Usage Reports
- CMicrosoft Purview eDiscovery
- DMicrosoft Purview Audit (Standard/Premium)
Show answer & explanationAnswer & explanation
Correct answer: D. Microsoft Purview Audit (Standard/Premium)
Microsoft Purview Audit provides a unified logging service across Microsoft 365 services, capturing administrative actions, user activities, and policy events. This log is crucial for security investigations and compliance audits.
Why the other options are wrong
- A. Azure AD Sign-in Logs specifically track user authentication events, not all administrative actions across the tenant.
- B. Usage Reports provide statistics on service adoption and activity, not detailed logs of administrative actions.
- C. eDiscovery is used for searching and exporting content for legal cases, not directly for unified activity logging.
Microsoft Purview Audit
A compliance solution in Microsoft 365 that provides a unified audit log of user and administrator activities across various Microsoft 365 services. It helps organizations investigate security incidents, perform compliance reviews, and meet regulatory obligations.
- Unified logging for Microsoft 365 activities.
- Captures user and administrator actions.
- Essential for security forensics and compliance audits.
Memory trick: Audit Log: Every action leaves a trace, for every admin, every user.