Describe security, compliance, privacy, and trust in Microsoft 365 →hardMultiple ChoiceObjective-mapped
Audit User Activities with Purview Audit (Standard) — Export CSV, 90-Day Retention
A security administrator needs to audit all activities related to a specific user in Exchange Online, SharePoint Online, and Microsoft Entra ID for the past 90 days. They also need to export the audit log as a CSV file. Which Microsoft Purview solution provides this capability without additional licensing beyond Microsoft 365 E3?
Quick Answer
Microsoft Purview Audit Standard covers this requirement completely within existing Microsoft 365 E3 licensing, because it already provides 90 days of searchable activity logging across Exchange Online, SharePoint Online, and Microsoft Entra ID, plus the ability to export search results as a CSV file for offline analysis or reporting. The 90-day window and the specific set of covered services are exactly what E3 includes at the Standard audit tier — no add-on or license upgrade is required to search a specific user's activity across those three services within that timeframe. This matters for the exam because Audit Premium exists as a separate, higher tier with extended retention beyond 90 days and access to additional high-value event types, and a scenario that specifically stays within the 90-day boundary and the standard set of services is deliberately testing whether you know Standard already covers it — recognising that boundary is what prevents over-licensing in a real deployment as well as on the exam.
⚠ Common exam trap
Many candidates confuse 'auditing user activities' with 'searching for content' and pick Content Search or eDiscovery, not realizing that audit logs track actions (like 'User logged in' or 'Deleted file') while Content Search finds the actual data files.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Audit (Standard)
Microsoft Purview Audit (Standard) is included with Microsoft 365 E3 and provides the ability to search and export audit logs for user activities across Exchange Online, SharePoint Online, and Microsoft Entra ID for up to 90 days. This meets the administrator's requirement without needing additional licensing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview Audit (Standard)
Why this is correct
Correct. Audit (Standard) is included with E3, retains logs for 90 days, covers the required services, and allows export to CSV.
- ✗
Microsoft Purview Audit (Premium)
Why it's wrong here
Audit (Premium) requires E5 or an add-on license; it is not included with E3 alone.
- ✗
Microsoft Purview eDiscovery (Standard)
Why it's wrong here
eDiscovery is used for searching and holding content (emails, documents), not for auditing user activity logs.
- ✗
Microsoft Purview Content Search
Why it's wrong here
Content Search is used to find content across mailboxes and sites, not to retrieve audit logs.
Go deeper
Related to this question
Learn chapter
Benefits of Microsoft Cloud
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Audit log
An audit log is a chronological record of security-relevant events and user activities within a system, used for monitoring, compliance, and forensic analysis.
About these practice questions
This MS-900 question is part of Courseiva's 217-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company needs to audit user activities in Microsoft 365 for compliance. Which tool should they use?
easy- A.Microsoft Defender XDR
- B.Microsoft Sentinel
- ✓ C.Microsoft Purview Audit (Premium)
- D.Microsoft Intune
Why C: Microsoft Purview Audit (Premium) provides comprehensive auditing of user and admin activities across Microsoft 365, making it the correct choice for compliance auditing. Option C is correct. Microsoft Defender XDR (A) is for security threat detection and response, not auditing. Microsoft Sentinel (B) is a SIEM for security analytics, not native audit logging. Microsoft Intune (D) is for device management and does not provide user activity auditing.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.