Study guide
Technical reference and lesson notes
Purpose of This Lesson
The Microsoft Purview unified audit log provides a central record of user and administrator activity across Microsoft 365. For an SC-200 analyst, understanding its licensing tiers is important because retention, search capacity, and investigation features directly affect whether historical evidence is available during an incident, forensic investigation, or compliance review.
Key Concepts
Microsoft Purview auditing
Microsoft Purview auditing collects searchable activity records from Microsoft 365 services. These records can support:
- Security investigations
- Insider-risk and internal investigations
- Forensic analysis
- Compliance and regulatory obligations
- Tracking administrative and user activity across a large tenant
The unified audit log is an activity source. It is not, by itself, an incident-management or detection platform. Analysts use its records alongside Microsoft Defender, Microsoft Sentinel, identity data, endpoint evidence, and other investigation sources.
Audit Standard and Audit Premium
Microsoft 365 auditing is commonly discussed in two capability tiers:
| Capability | Audit Standard | Audit Premium |
|---|---|---|
| Enabled by default | Yes | Yes, where licensed |
| Searchable audit events | Thousands of event types | Includes Standard capabilities with enhanced capacity and features |
| Purview portal search | Yes | Yes |
| Microsoft Graph access | Yes | Yes |
| Unified audit PowerShell cmdlet | Yes | Yes |
| Export records to CSV | Yes | Yes |
| Office 365 Management Activity API | Yes | Higher bandwidth/capacity |
| Audit log retention | 180 days | Longer retention options, including one-year and up-to-ten-year scenarios depending on licensing and policy configuration |
| Audit log retention policies | Limited compared with Premium | Yes |
| Intelligent insights | No | Yes |
The decisive exam distinction is that Premium is primarily about enhanced retention and advanced audit-management capabilities, not simply whether auditing exists.
Licensing requirements
The lecture identifies these licensing paths for Audit Premium:
- Microsoft 365 E5
- Microsoft 365 E5 Compliance
- Microsoft 365 E5 eDiscovery and Audit add-on
The relevant license must be assigned to the users whose activity requires Premium auditing. Licensing only an administrator or investigator does not automatically provide Premium-level auditing for every user in the tenant.
Always verify current Microsoft licensing documentation before making a production licensing decision. Product packaging and retention entitlements can change.
Microsoft Security Operations Context
The unified audit log is especially useful when an investigation involves Microsoft 365 actions rather than only endpoint or network activity. Examples include determining whether a user:
- Accessed or changed Microsoft 365 data
- Performed an administrative action
- Created, modified, or removed a configuration
- Took an action that needs to be correlated with an alert from Defender or Sentinel
A typical investigation flow may be:
- A Defender or Sentinel alert identifies a suspicious account or activity.
- The analyst searches the unified audit log for the account, operation, workload, and time range.
- Audit results are exported or accessed through an API when additional analysis is required.
- The analyst correlates the activity with sign-in logs, endpoint telemetry, email evidence, and other relevant sources.
- Findings are documented and escalated or contained according to the incident process.
Audit data can also reveal actions that occurred before an alert was generated. Retention therefore affects the investigation window: if the required event is older than the available retention period, the analyst may not be able to reconstruct the activity.
Exam-Relevant Takeaways
- Microsoft Purview provides the unified audit log for Microsoft 365 activity investigation.
- Audit Standard is enabled by default and includes portal search, searchable audit events, Graph API access, PowerShell access, CSV export, and the Office 365 Management Activity API.
- The lecture associates Standard retention with 180 days.
- Audit Premium adds longer retention, retention policies, intelligent insights, and higher API bandwidth.
- Premium retention options discussed include one year and up to ten years, subject to the applicable license and configuration.
- Microsoft 365 E5 includes the capabilities needed for Standard and Premium auditing.
- Microsoft 365 E5 Compliance and the Microsoft 365 eDiscovery and Audit add-on are additional licensing paths identified for Premium.
- The Premium license must be assigned to the users whose activities need Premium auditing.
- The audit log is evidence and activity telemetry; it is not a replacement for Defender incidents or Sentinel analytics rules.
Tool / Feature Decision Guide
| Investigation need | Appropriate capability | Why |
|---|---|---|
| Search recent Microsoft 365 activity interactively | Purview Audit search | Provides a portal-based search experience for audit events |
| Automate retrieval of audit records | Microsoft Graph or Office 365 Management Activity API | Supports programmatic collection and integration |
| Retrieve or process audit results with PowerShell | Unified audit PowerShell cmdlet | Useful for administrative and repeatable query workflows |
| Share or perform offline analysis on results | CSV export | Allows results to be reviewed or processed outside the portal |
| Investigate activity beyond the Standard retention window | Audit Premium with appropriate retention configuration | Provides longer retention options |
| Control how long particular audit records are retained | Audit Premium retention policies | Supports deliberate retention management rather than relying only on the default period |
| Obtain additional audit-related analytical insight | Audit Premium intelligent insights | Provides capabilities not included with Standard |
Common Exam Traps
- Confusing auditing with alerting: The unified audit log records activity; it does not automatically mean that every event becomes a security alert.
- Assuming the investigator’s license is sufficient: Premium coverage is associated with the licensed users whose activities are being audited.
- Treating Standard and Premium as separate logging systems: Premium extends auditing capabilities; it is not a completely different audit source.
- Ignoring retention: A successful search depends on the event still being retained. A missing result may indicate that the event is outside the retention period, not that the action never happened.
- Assuming ten-year retention is automatic: Long retention requires the relevant Premium entitlement and appropriate retention-policy configuration.
- Overlooking API differences: Standard provides API access, while Premium provides higher Office 365 Management Activity API bandwidth.
- Using Sentinel as the answer to every investigation question: Sentinel can ingest and correlate data, but the source of Microsoft 365 activity records may still be the Purview unified audit log.
Real-World SOC Analyst Notes
- Confirm the tenant’s licensing and retention configuration before promising that historical activity can be recovered.
- Preserve relevant audit results by exporting them or storing them in an approved investigation location when evidence may be needed later.
- Record the search criteria, investigator, time zone, time range, user identities, and filters used. This makes the investigation reproducible.
- Correlate audit events with Entra ID sign-ins, Defender alerts, mailbox activity, endpoint telemetry, and change-management records rather than interpreting an isolated event in a vacuum.
- Use API or PowerShell collection carefully. Broad, repeated searches can consume capacity and create unnecessary operational load.
- Treat retention-policy changes as a change-controlled operation. They can affect tenant-wide evidence availability, storage, cost, and compliance obligations.
- Limit access to audit data because it can contain sensitive information about users, administrators, and organizational activity.
- If the expected event is absent, check the workload, operation name, actor identity, time zone, ingestion delay, permissions, and retention period before concluding that no activity occurred.
Quick Reference Summary
- Standard: Default auditing, searchable events, portal search, APIs, PowerShell, CSV export, and approximately 180 days of retention as described in the lesson.
- Premium: Standard capabilities plus longer retention, retention policies, intelligent insights, and higher API bandwidth.
- Premium licensing paths: Microsoft 365 E5, Microsoft 365 E5 Compliance, or the Microsoft 365 eDiscovery and Audit add-on.
- User scope: Assign the relevant Premium license to the users whose actions require Premium auditing.
- Investigation principle: Use Purview audit records as Microsoft 365 activity evidence and correlate them with the rest of the SOC data set.
Flashcards
Q: An investigation requires Microsoft 365 activity records from more than the Standard retention period. Which capability should the analyst verify first?
A: Verify that Audit Premium is licensed for the relevant users and that an appropriate retention configuration is in place. Premium provides the longer retention options discussed in the lesson.
Q: What is the main distinction between Audit Standard and Audit Premium?
A: Standard provides core audit search and access capabilities, while Premium adds longer retention, retention policies, intelligent insights, and higher API bandwidth.
Q: Which Microsoft Purview feature should an analyst use to interactively search Microsoft 365 user and administrator activity?
A: Use the Audit search experience in the Microsoft Purview portal. It is the interactive investigation interface for unified audit records.
Q: When would the Office 365 Management Activity API be preferable to portal search?
A: Use the API when audit records must be collected programmatically, integrated with another system, or retrieved repeatedly at scale. Premium provides higher API bandwidth than Standard.
Q: What is the exam trap involving the license of the person performing an audit search?
A: The investigator’s license alone does not automatically grant Premium auditing for every user. Premium licensing must cover the users whose activities require those capabilities.
Q: Which licensing options identified in the lesson can provide Audit Premium?
A: Microsoft 365 E5, Microsoft 365 E5 Compliance, and the Microsoft 365 eDiscovery and Audit add-on.
Q: What can an analyst do with unified audit results besides view them in the Purview portal?
A: Results can be accessed through Microsoft Graph or the Office 365 Management Activity API, retrieved with the unified audit PowerShell cmdlet, or exported to CSV.
Q: A search returns no result for a suspected action. Why should the analyst check retention before dismissing the lead?
A: The event may have aged out of the available retention period. An absent result does not prove that the action did not occur.
Q: Which capability should be selected when an organization needs to define how long audit records are retained?
A: Audit Premium retention policies should be evaluated because they provide deliberate audit-retention management beyond the basic Standard capability.
Q: Does the unified audit log automatically function as a security alerting system?
A: No. It records Microsoft 365 activity for search and investigation. Alerts and incidents may be generated by Defender or Sentinel and then correlated with audit records.
Q: What is the practical value of CSV export during an investigation?
A: CSV export supports offline review, evidence preservation in an approved location, and additional analysis outside the Purview portal.
Q: What additional analytical capability is associated with Audit Premium in the lesson?
A: Premium includes intelligent insights, which are not listed as part of Audit Standard.
Practice Questions
Question 1
A SOC analyst is investigating whether a compromised user performed suspicious Microsoft 365 actions six months ago. The tenant has only the Standard auditing capability described in the lesson. What is the most important limitation?
A. The analyst cannot search audit records through the Purview portal.
B. The analyst cannot export audit records to CSV.
C. The activity may be outside the approximately 180-day Standard retention period.
D. The unified audit log records only endpoint activity.
Correct answer: C
Standard includes Purview search and CSV export, but the lesson associates Standard with approximately 180 days of retention. A six-month-old event may therefore be unavailable depending on the exact timing and tenant configuration.
Question 2
An organization uses Microsoft 365 E3 and needs longer audit retention, retention policies, and intelligent insights. Which licensing approach best matches the lesson?
A. License only the SOC analysts with Microsoft 365 E5.
B. Add Microsoft 365 E5 Compliance or the Microsoft 365 eDiscovery and Audit add-on as appropriate, and license the relevant users.
C. Enable a Sentinel workbook because it automatically extends Purview retention.
D. Export Standard audit logs to CSV because CSV files automatically provide ten-year retention.
Correct answer: B
The lesson identifies Microsoft 365 E5 Compliance and the Microsoft 365 eDiscovery and Audit add-on as Premium licensing paths. The relevant users’ activities must be covered; an analyst-only license does not automatically cover the entire tenant.
Question 3
A SOC team wants to collect audit records on a recurring basis and integrate them into an internal investigation workflow. Which access method is most appropriate?
A. Microsoft Graph or the Office 365 Management Activity API
B. Manual screenshots of the Purview portal
C. An endpoint antivirus scan
D. An Entra ID password reset
Correct answer: A
The APIs support programmatic retrieval and integration. Premium also provides higher Office 365 Management Activity API bandwidth.
Question 4
An analyst sees a Defender alert for suspicious administrator activity and needs to determine which Microsoft 365 operation occurred. What should the analyst do?
A. Use the unified audit log to search the actor, operation, workload, and time range, then correlate the result with the Defender alert.
B. Assume that the Defender alert contains every Microsoft 365 audit event.
C. Search only endpoint telemetry because Purview records network traffic.
D. Change the audit-retention policy immediately without documenting the change.
Correct answer: A
Purview audit records provide Microsoft 365 activity evidence. The correct workflow is to search and correlate the audit event with other security telemetry, while handling retention-policy changes through proper change control.
Question 5
Which statement correctly describes Audit Premium compared with Audit Standard?
A. Premium removes the need for Microsoft 365 activity records because it generates only alerts.
B. Standard has no API or PowerShell access.
C. Premium adds longer retention, retention policies, intelligent insights, and higher API bandwidth.
D. Premium is available only through Microsoft 365 E3 without any add-on.
Correct answer: C
Standard already includes core search and access capabilities. Premium extends those capabilities with the retention and management features emphasized in the lesson.