Microsoft 365 FundamentalsDescribe security, compliance, privacy, and trust in Microsoft 365Hard
A Microsoft 365 administrator is tasked with ensuring that all administrative actions performed within the Microsoft 365 environment, such as changing user permissions, configuring tenant settings, or creating new sites, are recorded and immutable. This is critical for forensic investigations and demonstrating accountability during security audits. Which Microsoft Purview feature provides a comprehensive and tamper-proof record of these administrative activities?
- AMicrosoft Purview eDiscovery
- BMicrosoft Purview Data Loss Prevention (DLP)
- CMicrosoft Purview Records Management
- DMicrosoft Purview Audit (Premium)
Show answer & explanationAnswer & explanation
Correct answer: D. Microsoft Purview Audit (Premium)
Microsoft Purview Audit (Premium) provides a comprehensive, tamper-proof audit log that records administrative activities across Microsoft 365 services. It offers longer retention of audit logs, higher bandwidth for searching, and more advanced events than standard audit, which is crucial for detailed forensic investigations and demonstrating accountability during audits.
Why the other options are wrong
- A. Microsoft Purview eDiscovery is used for legal discovery to search and export content, not for recording administrative actions.
- B. Microsoft Purview Data Loss Prevention (DLP) prevents sensitive data from being shared inappropriately, not for recording administrative actions.
- C. Microsoft Purview Records Management manages the lifecycle of records, not specifically administrative action logging.
Microsoft Purview Audit (Premium)
An enhanced auditing solution in Microsoft 365 that offers longer retention of audit logs, higher-bandwidth access, and more critical events for advanced forensic and compliance investigations.
- Retains audit logs for up to 10 years (with appropriate licenses).
- Provides access to more advanced audit events.
- Offers higher bandwidth for performing audit log searches.
- Essential for detailed forensic analysis and regulatory compliance.
Memory trick: Premium audit logs every admin's move, forever.