Microsoft Purview Audit (Premium) for Forensic Logs
A security team needs to investigate a potential data breach in Microsoft 365. They require detailed forensic logs showing every instance of mailbox access, mailbox search performed by administrators, and changes to email forwarding rules in Exchange Online. The logs must be retained for 1 year. Which Microsoft Purview solution should they use?
Quick Answer
Audit (Premium) is the answer because this scenario asks for exactly the category of event it exists to capture: high-value, user-level actions like an individual mailbox access, an administrator running a mailbox search, or a change to a forwarding rule. Audit (Standard), included by default, logs a broader but shallower set of activity and keeps it for only 90 days, which already rules it out once the requirement specifies one-year retention. Audit (Premium) extends both dimensions at once — it adds the forensic-grade event categories a breach investigation actually needs and extends retention to a year for licensed users, so the two requirements in this scenario (event granularity and retention length) point to the same feature rather than two separate ones. It's worth keeping Audit (Premium) distinct from eDiscovery in your head: eDiscovery searches and exports existing content for legal or investigative holds, while Audit is the ongoing log of who did what and when. Any scenario naming specific administrative or mailbox-level actions alongside a retention period beyond 90 days is pointing at Audit (Premium).
⚠ Common exam trap
Many candidates confuse eDiscovery (which is for searching and exporting content) with auditing (which is for logging events), and they underestimate the specific event types that require Audit (Premium) over Audit (Standard).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Audit (Premium)
Audit (Premium) is required because the question specifies detailed forensic logs for mailbox access, administrator mailbox searches, and changes to email forwarding rules—all of which are high-value, user-specific events that are only captured by Audit (Premium). Audit (Standard) logs basic events but lacks the granularity for these specific operations, and it retains logs for only 90 days by default, whereas Audit (Premium) supports up to 1 year of retention. eDiscovery solutions are for searching and exporting content, not for continuous logging of administrative actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Audit (Standard)
Why it's wrong here
Audit (Standard) logs fewer event types and retains logs for only 90 days, insufficient for the detailed forensic requirements and 1-year retention.
- ✓
Audit (Premium)
Why this is correct
Audit (Premium) logs high-value events like mailbox access and forwarding rule changes, and supports up to 1-year retention, making it the correct choice.
- ✗
eDiscovery (Standard)
Why it's wrong here
eDiscovery (Standard) is used to search and hold content for legal cases, not to provide detailed forensic audit logs of administrator actions.
- ✗
eDiscovery (Premium)
Why it's wrong here
eDiscovery (Premium) adds advanced analytics and review capabilities for legal cases, but does not log administrative actions or provide long-term audit retention.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Exchange Online
Exchange Online is Microsoft's cloud-based email, calendar, and contact hosting service that is part of the Microsoft 365 suite, allowing organizations to manage corporate messaging without maintaining their own mail servers.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team needs to investigate a potential data breach that may involve unauthorized access to sensitive files in SharePoint Online and OneDrive for Business. They want to search the unified audit log for file access events, including accesses from mobile devices and third-party applications. Additionally, they need to create custom alert policies that trigger when specific high-privilege users download large volumes of files in a short period. Which Microsoft Purview solution should they use?
hard- ✓ A.Microsoft Purview Audit (Premium)
- B.Microsoft Purview eDiscovery (Premium)
- C.Microsoft Purview Data Lifecycle Management
- D.Microsoft Purview Communication Compliance
Why A: Microsoft Purview Audit (Premium) is the correct solution because it provides the deep, granular logging required to investigate data breaches, including file access events from mobile devices and third-party applications in SharePoint Online and OneDrive for Business. It also supports the creation of custom alert policies that can trigger on specific activities, such as high-privilege users downloading large volumes of files in a short period, by leveraging the unified audit log's rich schema and advanced detection capabilities.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.