Microsoft 365 FundamentalsDescribe security, compliance, privacy, and trust in Microsoft 365Hard
A Microsoft 365 global administrator is investigating a potential data breach where sensitive customer information might have been accessed by an unauthorized individual. The administrator needs to identify exactly which files were accessed, when, and by whom, across SharePoint Online and OneDrive for Business. Which Microsoft 365 compliance tool is specifically designed for these types of detailed forensic investigations?
- AMicrosoft Purview Data Loss Prevention (DLP)
- BMicrosoft Purview Information Barriers
- CMicrosoft Purview eDiscovery
- DMicrosoft Purview Audit (Premium)
Show answer & explanationAnswer & explanation
Correct answer: D. Microsoft Purview Audit (Premium)
Microsoft Purview Audit (Premium) extends the capabilities of standard auditing by providing longer retention of audit logs (up to 10 years), higher fidelity logging for critical events (like file access), and advanced forensic capabilities, which are essential for detailed investigations like data breaches.
Why the other options are wrong
- A. DLP prevents data loss, but it's not a forensic tool for investigating past access events.
- B. Information Barriers prevent communication between specific user groups, not for auditing past file access.
- C. eDiscovery is for legal holds and searching for content, not primarily for detailed forensic logs of who accessed what files when.
Microsoft Purview Audit (Premium)
An advanced auditing solution in Microsoft 365 that provides extended audit log retention, higher fidelity logging (e.g., for file access), and intelligent insights to support forensic and compliance investigations. It is a key tool for detailed security incident response.
- Extended audit log retention (up to 10 years).
- Logs high-fidelity events like file access.
- Essential for in-depth forensic investigations.
Memory trick: Audit Premium: Your digital detective for deep dives into past activities.