Enabling and Accessing Audit Logs for Power BI
You need to audit Power BI activities such as viewing reports, sharing dashboards, and exporting data. Which TWO actions should you take to enable and access audit logs? (Choose two.)
Quick Answer
Enabling the 'Create audit logs for Power BI activities' tenant setting in the admin portal is the necessary first step because Power BI doesn't log activities like viewing reports, sharing dashboards, or exporting data by default; auditing has to be explicitly turned on before any of those actions start being recorded at all. Once that setting is enabled, the second required action is retrieving the logged activity from where it's actually stored, the Microsoft 365 compliance portal rather than anywhere inside Power BI itself, since Power BI activity logging plugs into the same underlying audit infrastructure used across Microsoft 365. Together these two steps cover the full path from nothing being recorded to being able to review what happened: turn logging on, then go to the compliance portal to see the results. The other tools named in scenarios like this solve different problems -- Microsoft Defender for Cloud Apps can integrate with audit data but isn't the primary place logs live, there's no built-in feature to export Power BI logs straight to CSV, and Azure Monitor diagnostic settings apply to Azure resources rather than Power BI activity. When a question involves enabling and then retrieving a Microsoft 365 or Power BI audit trail, expect the answer to split into exactly these two steps: turn on logging, then read it from the compliance portal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access the audit log from the Microsoft 365 compliance portal.
To audit Power BI activities, you must first enable audit logging by turning on the 'Create audit logs for Power BI activities' tenant setting in the Power BI admin portal (option C). Once enabled, you can access the audit logs from the Microsoft 365 compliance portal (option B). Option A is incorrect because Microsoft Defender for Cloud Apps is not the primary location for audit logs; it can integrate but is not required. Option D is incorrect because Power BI does not have an export feature for audit logs to CSV; you can export from the compliance portal. Option E is incorrect because Azure Monitor diagnostic settings are for Azure resources, not for Power BI audit logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Microsoft Defender for Cloud Apps to forward logs to Microsoft Sentinel.
Why it's wrong here
Defender for Cloud Apps forwards alerts and discovered-app events to Microsoft Sentinel, but it does not generate the Power BI activity audit records; those must first be enabled in the Microsoft 365 audit log. It is tempting because Sentinel ingestion is a valid SIEM pattern, yet it consumes logs rather than producing the required audit trail.
- ✓
Access the audit log from the Microsoft 365 compliance portal.
Why this is correct
Microsoft 365 compliance portal surfaces the unified audit log, which captures Power BI activities including report views, dashboard shares and exports. Because the stem requires auditing those specific events, retrieving them here satisfies the requirement; the log aggregates Microsoft Entra ID-authenticated activity across workloads rather than Power BI service settings alone.
- ✓
Enable the 'Create audit logs for Power BI activities' tenant setting in the admin portal.
Why this is correct
The tenant-level audit setting is the prerequisite switch: until an administrator enables it in the admin portal, Power BI generates no activity records at all. Enabling it satisfies the stem's requirement to make viewing, sharing and export events auditable.
- ✗
Use the 'Export' feature in Power BI to export audit logs to a CSV file.
Why it's wrong here
Exporting report data to CSV produces dataset rows, not the tenant activity records that audit logging generates; the audit log is retrieved through the Microsoft 365 Purview audit search or the Power BI activity log API. The Export feature is tempting because it extracts data from visuals, which is a reporting task, not an auditing one.
- ✗
Set up a diagnostic setting in Azure Monitor to collect Power BI logs.
Why it's wrong here
Azure Monitor diagnostic settings collect Power BI logs only when the workspace or capacity is configured to emit them, and they capture engine and resource telemetry rather than the user activity events (report views, shares, exports) the audit requires. It is tempting because Azure Monitor is the standard route for platform telemetry, but the activity audit lives in the Microsoft 365 audit log.
Go deeper
Related to this question
About these practice questions
One of 524 original PL-300 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on PL-300
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are a Power BI administrator. You need to audit all activities related to sharing reports and dashboards in the Power BI service. Which tool should you use?
hard- A.Microsoft Purview compliance portal audit log
- B.Azure diagnostic settings for Power BI
- ✓ C.Power BI activity log (via admin API or portal)
- D.Microsoft Sentinel
Why C: The Power BI activity log provides a comprehensive record of all user activities within the Power BI service, including sharing reports and dashboards. Option A (Microsoft Purview compliance portal audit log) can capture some Power BI activities but is less specific and may not include all sharing events. Option B (Azure diagnostic settings) exports telemetry data to other destinations and is not designed for direct auditing of user actions. Option D (Microsoft Sentinel) is a SIEM tool that can ingest logs but is not the primary tool for auditing Power BI activities. The Power BI activity log is the correct choice as it is purpose-built for auditing Power BI user activities.
Variation 2. An administrator wants to monitor all Power BI activities, including viewing reports, exporting data, and sharing workspaces. Which tool should they use?
easy- ✓ A.Power BI activity log in the admin portal
- B.Power BI usage metrics report
- C.Power BI capacity metrics app
- D.Microsoft 365 audit log
Why A: The Power BI activity log captures user activities such as viewing, exporting, and sharing. Option B is wrong because the usage metrics report shows aggregate usage, not detailed activities. Option C is wrong because the Power BI capacity metrics app focuses on performance and capacity metrics, not user activities. Option D is wrong because the Microsoft 365 audit log is broader but less specific to Power BI; the activity log is the dedicated tool.
Variation 3. You need to audit Power BI activity for compliance. Which tool should you use to access detailed logs of user actions?
easy- A.Microsoft Defender XDR
- ✓ B.Microsoft Purview compliance portal (Audit)
- C.Microsoft Purview Data Map
- D.Power BI Premium capacity metrics app
Why B: The correct option is B, Microsoft Purview compliance portal (Audit), because it provides the unified audit log that captures detailed Power BI user activity such as viewed reports, edited datasets, shared dashboards, and exported data, which is exactly what a compliance audit requires. Power BI activity events are surfaced through the Microsoft 365 audit log, accessible via the Purview compliance portal's Audit search (or the Search-UnifiedAuditLog cmdlet), letting you filter by workload, user, and date. Option A, Microsoft Defender XDR, focuses on security incidents and threat detection across endpoints, identities, and email, not on Power BI activity auditing. Option C, Microsoft Purview Data Map, catalogs and classifies data assets for governance but does not record user action logs. Option D, the Power BI Premium capacity metrics app, reports on capacity utilization and performance metrics, not detailed per-user activity logs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PL-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PL-300 exam.