Microsoft Purview Audit Search and Permissions – SC-200 Study Guide

Purpose of This Lesson

Microsoft Purview Audit provides a centralized way to search user and administrative activity across Microsoft 365 workloads. For an SC-200 analyst, audit data helps reconstruct what happened, identify suspicious account or file activity, validate whether an action succeeded, and preserve investigation evidence.

This lesson focuses on the Purview portal workflow for searching audit activity, narrowing results, inspecting event details, and exporting evidence. Access depends on appropriate audit permissions and on audit data being available for the tenant and workload.

Key Concepts

Microsoft Purview Audit

Microsoft Purview Audit is accessed through the Microsoft 365 admin center by opening Show all, selecting Compliance, and then opening Audit in Microsoft Purview.

The audit search interface supports filters such as:

• Start and end date
• Activity type
• User
• File, folder, or site
• Workload
• Keywords
• Administrative unit
• IP address and other available event fields

Audit searches can return activity from multiple Microsoft 365 services, including identity, Exchange, SharePoint, OneDrive, and other workloads. The exact activities and fields available depend on the workload and event type.

Unified Audit Search

A broad audit search can aggregate events from across Microsoft 365 rather than requiring an analyst to investigate each workload separately. This is useful when the scope is initially unknown—for example, when determining whether a compromised identity accessed files, changed mailbox settings, or performed administrative actions.

A broad search can produce a large result set and may take significant time to complete. A better operational pattern is often:

1. Define the investigation time window.
2. Identify the user, IP address, workload, or activity of interest.
3. Run a focused search.
4. Narrow the returned results further.
5. Open individual events and preserve relevant evidence.

Event Details and JSON

Selecting an audit event exposes more detail, such as:

• Creation or event time
• User or service account
• Workload and operation
• Result or status, such as successful sign-in
• Source information, including an IP address when available
• Object, mailbox, file, or administrative context
• Raw or structured JSON event data

The event details are more valuable than the result summary alone. The JSON representation can provide fields needed for correlation with identity, endpoint, email, or cloud-application investigations.

Audit Permissions and Availability

Searching audit data requires an account with the necessary Microsoft Purview audit permissions. In a production tenant, use least privilege and assign access through the appropriate Purview role group or audit-related role rather than granting broad tenant administration rights.

Before troubleshooting an apparently empty search, verify:

• The analyst has permission to search audit data.
• Unified audit logging and the required audit capability are available for the tenant.
• The selected date range is valid.
• The workload generates the activity being investigated.
• The event has had enough time to become searchable.
• Retention and licensing limits have not removed or restricted the required data.

The lecture demonstrates the search experience; it does not establish that every audit event is real-time, available indefinitely, or identical across workloads.

Microsoft Security Operations Context

Purview Audit is primarily an activity and evidence source. It is not a replacement for Microsoft Defender XDR incidents, Microsoft Sentinel analytics rules, or Entra ID sign-in investigation. A SOC analyst normally correlates audit events with other sources:

• Entra ID: Sign-ins, authentication context, user and administrative activity
• Microsoft Defender XDR: Correlated incidents and alerts across Microsoft security products
• Defender for Endpoint: Device activity and endpoint evidence
• Defender for Office 365: Email, phishing, and collaboration-related signals
• Microsoft Sentinel: Cross-source investigation, analytics, hunting, workbooks, and automation
• Purview Audit: Microsoft 365 user and administrative actions, including file, mailbox, and service activity

For example, a suspicious Entra sign-in may be followed by a Purview audit search for file access, mailbox changes, or other actions performed by the same account. The audit event can help establish what the identity did after authentication, while Defender or Sentinel may provide detection, correlation, and response workflows.

Exam-Relevant Takeaways

• Microsoft Purview Audit is the Microsoft 365 portal experience for searching audit activity.
• Search results can be scoped by time, activity, user, file or site, workload, keyword, and administrative unit.
• A search that covers everything can take a long time and return a very large result set.
• Analysts can continue filtering after the initial search completes.
• Opening an event provides more context than the result list, including status, timestamps, actor information, and JSON data.
• Audit events can include actions performed by service or system accounts, not only human users.
• Export is available when evidence must be retained or analyzed elsewhere, but large exports may take time.
• Audit data should be correlated with identity, endpoint, email, and SIEM data rather than interpreted in isolation.
• Appropriate Purview audit permissions are required; do not assume that every administrator or analyst automatically has audit-search access.

Tool / Feature Decision Guide

Investigation need	Appropriate approach	Why
Determine what Microsoft 365 action occurred	Purview Audit search	Searches user and administrative activity across supported workloads
Investigate one user’s activity during a known period	Filter by user and time range	Reduces noise and improves search efficiency
Identify activity involving a particular SharePoint or OneDrive object	Filter by file, folder, site, and activity	Focuses the search on the relevant collaboration resource
Determine whether an action succeeded	Open the individual audit event	The detailed record includes the result or status and additional context
Correlate an audit event with other security signals	Use event time, user, IP, workload, and object details in Defender or Sentinel	These fields help connect activity across security tools
Preserve a large set of audit evidence	Use the export capability after narrowing the results	Export is useful for offline review, case documentation, or handoff
Investigate endpoint execution or persistence	Use Defender for Endpoint or another endpoint data source	Purview Audit records Microsoft 365 activity, not complete endpoint telemetry
Build recurring detections from multiple data sources	Use Microsoft Sentinel analytics rules or Defender detections	A one-time Purview search is not a recurring detection mechanism

Common Exam Traps

• Confusing audit search with sign-in logs: Purview Audit can contain identity-related events, but Entra ID sign-in logs remain the primary source for detailed authentication investigation.
• Assuming a broad search is the best first step: Searching every activity and workload can be slow and difficult to analyze. Use known indicators to narrow the query where possible.
• Treating the result count as the complete investigation: A count only indicates how many records matched. Open events and examine their details.
• Ignoring service accounts: System or service identities may legitimately generate events, but they can also be relevant to abuse or persistence. Validate the account and expected behavior.
• Assuming all events are immediately available: Audit ingestion and search availability can have delay, and retention varies by service, configuration, and licensing.
• Granting excessive permissions: Audit investigation does not automatically justify broad Microsoft 365 or tenant administrator access.
• Assuming an audit event proves malicious intent: A successful operation confirms that an action occurred, not that it was unauthorized. Correlate with user intent, location, device, IP address, and surrounding activity.
• Using Purview Audit as a replacement for SIEM detection: Audit search supports investigation; Sentinel and Defender capabilities are better suited to alerting, correlation, and response workflows.

Real-World SOC Analyst Notes

Start Narrow, Then Expand

Use the smallest useful time window and the strongest known indicator first. Searching an entire month across every workload may be appropriate for scoping an unknown incident, but it is inefficient for a known user, IP address, or file.

Preserve Evidence Carefully

Record the search criteria, time zone, result count, event timestamps, actor, workload, operation, object, status, and relevant JSON fields. Export the result when required by the incident process, but preserve the original context so another analyst can reproduce the search.

Account for Time and Retention

Audit searches are not necessarily real-time. If an expected event is missing, consider ingestion delay, the selected date range, workload coverage, permissions, licensing, and retention. Avoid concluding that an action did not occur solely because it is not yet visible.

Validate Automation and Escalation

Purview data can support an incident timeline and escalation to identity, messaging, collaboration, or compliance teams. If a suspicious account is found, coordinate response actions with the incident procedure. Do not disable accounts, remove access, or delete content solely from an ambiguous audit record.

Use Cross-Tool Correlation

A useful investigation often links:

• A sign-in or authentication event
• The source IP and device context
• Microsoft 365 file, mailbox, or administrative activity
• Defender alerts or endpoint evidence
• Any Sentinel incident, analytics rule, or playbook activity

This reduces false positives and helps distinguish normal administrative automation from account compromise.

Quick Reference Summary

• Open Microsoft Purview > Audit from the Microsoft 365 admin center.
• Use time, activity, user, object, workload, keyword, administrative unit, or IP-related filters.
• Expect broad searches to take longer and return more noise.
• Select an event to inspect detailed fields and JSON data.
• Export results when evidence needs to be retained or reviewed outside the portal.
• Confirm audit permissions, data availability, ingestion timing, and retention before treating missing data as proof of no activity.
• Correlate Purview Audit with Entra ID, Defender, and Sentinel data.

Flashcards

Q: Which Microsoft portal experience should you use to search Microsoft 365 user and administrative activity across supported workloads?
A: Use Microsoft Purview Audit, opened from the Microsoft 365 admin center through Show all > Compliance > Audit.

Q: An investigation concerns one user’s activity during a known two-hour period. What should you do before searching every workload for an entire month?
A: Use the narrow time range and filter by the user, then add the relevant activity or workload. Focused searches reduce processing time and result noise.

Q: Why should an analyst open an individual Purview Audit result instead of relying only on the result list?
A: The event details provide the operation, status, actor, timestamps, context, and often structured JSON needed for validation and correlation.

Q: What is the main operational drawback of a full-blown audit search across a broad date range?
A: It can take a long time to complete and produce a large, noisy result set that is harder to analyze.

Q: Which audit filters are especially useful when investigating possible unauthorized access to a collaboration resource?
A: Filter by the relevant time range, user, file, folder, site, activity, or workload. These filters help isolate access and modification operations.

Q: An audit record shows a successful operation by an NT Authority or service account. What should the analyst conclude?
A: The account performed or generated the recorded action, but the event alone does not establish maliciousness. Validate whether the service behavior is expected and correlate it with surrounding activity.

Q: When would you export Purview Audit results?
A: Export them when a narrowed result set must be preserved, reviewed offline, shared with an investigation team, or attached to case documentation. Large exports may take time.

Q: What permission principle applies when enabling analysts to search audit data?
A: Grant the least-privileged Purview audit access needed for the role. Do not provide broad tenant administration rights when audit-search permissions are sufficient.

Q: How does Purview Audit differ from Entra ID sign-in logs in an investigation?
A: Purview Audit focuses on Microsoft 365 activity and operations, while Entra ID sign-in logs focus on authentication and sign-in context. They should be correlated rather than treated as interchangeable.

Q: Which tool is more appropriate for recurring cross-source detection than a one-time Purview Audit search?
A: Microsoft Sentinel analytics rules or Microsoft Defender detections are more appropriate for recurring detection and alerting; Purview Audit is primarily a search and investigation source.

Q: An expected audit event is not visible immediately after an action. What should you check before declaring that the action did not occur?
A: Check ingestion delay, the selected time range, permissions, workload support, tenant capabilities, and retention or licensing limitations.

Q: What does a successful audit result prove—and what does it not prove?
A: It supports that the recorded operation occurred successfully. It does not by itself prove that the action was malicious or unauthorized.

Practice Questions

Question 1

A SOC analyst is investigating suspected misuse of a SharePoint document. The analyst knows the site, the suspected user, and the approximate time of access. Which approach is most efficient?

A. Search all workloads for the entire audit-retention period
B. Search Purview Audit using the site, user, activity, and narrow time range
C. Search only Defender for Endpoint process events
D. Create a Sentinel analytics rule before reviewing the evidence

Correct answer: B

Explanation: Purview Audit supports filtering by user, file or folder, site, activity, workload, and date. Starting with known investigation indicators reduces search time and noise.

Question 2

A search returns thousands of events. An analyst wants to determine whether a mailbox configuration change succeeded and which account performed it. What should the analyst do next?

A. Assume every returned event represents a successful change
B. Open the individual event and inspect its detailed fields and JSON
C. Delete unrelated events from the tenant
D. Treat the total result count as the incident timeline

Correct answer: B

Explanation: Individual event details provide the actor, operation, result or status, timestamp, and structured data needed to validate what happened.

Question 3

An analyst cannot find an audit event for an action that occurred shortly ago. Which conclusion is most appropriate initially?

A. The user definitely did not perform the action
B. The audit service is permanently disabled
C. The analyst should verify permissions, ingestion delay, workload coverage, date range, and retention
D. The endpoint must have deleted the audit record

Correct answer: C

Explanation: Audit data may not be immediately searchable, and availability depends on permissions, workload support, tenant configuration, licensing, and retention. Absence of an immediate result is not proof that the action did not occur.

Question 4

A Purview audit event shows a successful login or administrative operation from a system account. What is the best next step?

A. Classify it as malicious solely because the account is not a human user
B. Ignore it because system accounts cannot be investigated
C. Validate whether the activity is expected and correlate it with identity, IP, workload, and other security telemetry
D. Export every event in the tenant without further filtering

Correct answer: C

Explanation: Service and system accounts can generate legitimate background activity, but their actions may also be relevant to abuse. Context and cross-tool correlation are required.

Question 5

An incident requires recurring detection of suspicious activity across identity, endpoint, and Microsoft 365 data. Which capability is the best fit?

A. A single broad Purview Audit search
B. Microsoft Sentinel analytics rules or Microsoft Defender detections
C. Manual export of audit results once per month
D. A Purview keyword search with no time filter

Correct answer: B

Explanation: Purview Audit is valuable for investigation and evidence review, while Sentinel analytics rules and Defender detections support recurring detection and alerting across security data sources.