3.5.1. Microsoft Purview Audit
💡 First Principle: The unified audit log records user and admin activity across Microsoft 365 services (Exchange, SharePoint, OneDrive, Teams, Entra ID, and more) in one searchable place. Its usefulness in an investigation depends on two settings you choose before the incident: how long records are kept and which detailed events are captured.
| Audit (Standard) | Audit (Premium) | |
|---|---|---|
| On by default | Yes | Yes (with eligible licensing) |
| Default retention | 180 days | 1 year for Exchange, SharePoint, OneDrive, and Entra ID records |
| Longer retention | No | Audit retention policies; up to 10 years with an add-on license |
| Intelligent insights | No | Yes, such as sensitivity-label detail on MailItemsAccessed and search queries in Exchange and SharePoint |
| API bandwidth | Baseline | About double |
Searching happens in the Microsoft Purview portal's Audit solution: filter by date range, activities, users, and workload, then export results to CSV. Scripted searches use the Search-UnifiedAuditLog cmdlet in Exchange Online PowerShell; the Office 365 Management Activity API streams records to SIEM tools, and Sentinel's Microsoft 365 connector ingests Exchange, SharePoint, and Teams activity into the OfficeActivity table.
Investigation patterns the exam favors:
- Business email compromise:
New-InboxRuleandSet-InboxRule(forwarding or deletion rules),Set-Mailboxforwarding changes,Sendevents, andMailItemsAccessed, which shows which messages were read by sync or bind access, which is how you scope what an attacker saw. - Data exfiltration:
FileDownloaded,FileSyncDownloadedFull,FileAccessed, and sharing events (SharingSet,AnonymousLinkCreated) in SharePoint and OneDrive. - Admin abuse: role assignment changes, mailbox permission grants (
Add-MailboxPermission), and Conditional Access policy changes.
Auditing must be on and records must still be within retention for any of this to exist. Mailbox auditing is on by default, but organizations should confirm that the actions they need are audited.
⚠️ Exam Trap: "Determine exactly which email messages an attacker read in a compromised mailbox" is answered with MailItemsAccessed audit records, provided auditing was on and the records are still within retention. Message trace shows delivery, not reading; Content search shows content, not access.
Reflection Question: A breach is discovered 200 days after it began. With Audit (Standard) only, what evidence is already gone, and what configuration would have preserved it?
