Microsoft Purview Audit (Premium) Capabilities
Your organization needs to audit all changes to sensitive files in SharePoint Online for at least 180 days. Which Microsoft Purview feature should be enabled?
⚠ Common exam trap
Watch out — candidates often confuse the 90-day default retention of standard audit with the extended retention of Audit (Premium), and mistakenly choose eDiscovery because it sounds like it involves logs, but eDiscovery is for content search, not audit log retention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Audit (Premium)
Microsoft Purview Audit (Premium) provides the extended retention of audit logs (up to 10 years) and the ability to search for high-value events such as changes to sensitive files. For a requirement of at least 180 days, Audit (Premium) is necessary because standard audit logs are retained for only 90 days. This feature logs all modifications to SharePoint Online files, including who changed what and when, meeting the auditing requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery is primarily designed for identifying, preserving, collecting, processing, reviewing, and exporting electronic data for legal or investigative purposes. While it can retrieve content, it does not generate or store the granular, continuous audit logs that record specific user or system actions on files. Its function is reactive content retrieval and analysis for litigation or investigations, not the proactive logging of every change or access event to sensitive data.
- ✓
Microsoft Purview Audit (Premium)
Why this is correct
Microsoft Purview Audit (Premium) is the correct solution because it provides advanced auditing capabilities specifically designed to capture and retain detailed user and admin activities across Microsoft 365 services. It offers extended retention of audit logs for up to one year (or 10 years with an add-on license) and access to crucial audit events like file and folder activities, enabling organizations to perform forensic investigations, respond to regulatory requests, and proactively monitor changes to sensitive files with high fidelity.
- ✗
Microsoft Purview Data Loss Prevention
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) is engineered to identify, monitor, and protect sensitive information by preventing its unauthorized sharing or transfer outside of defined boundaries. While DLP policies can detect when sensitive data is being moved or shared, its core function is policy enforcement and prevention, not the comprehensive logging and retention of all user and system activities on files for general audit purposes. DLP generates incidents when policies are violated, but it doesn't provide the detailed, continuous audit trail required to understand every modification or access event.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management (DLM) focuses on governing the retention and deletion of data within an organization based on regulatory, legal, and business requirements, ensuring content is kept for the necessary period and then appropriately disposed of. It manages the content itself, dictating its lifespan. While DLM is crucial for compliance, it does not generate or provide the detailed, immutable audit logs that record every change or access event to sensitive files; its scope is the content's lifespan, not the activity history of user interactions with that content.
Go deeper
Related to this question
Learn chapter
eDiscovery and Audit
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
About these practice questions
One of 1,279 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are required to use Microsoft Purview Audit (Premium)?
hard- ✓ A.Unified audit log enabled in the Microsoft 365 Defender portal
- ✓ B.An E5 or A5 license for each user
- C.An Azure subscription for log storage
- D.Power BI Pro licenses for all users
- E.Microsoft Sentinel enabled
Why A: Option A is correct because Microsoft Purview Audit (Premium) builds on the unified audit log, so auditing must first be turned on in the Microsoft 365 Defender portal (or via Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true) before premium features such as longer retention and high-value events can be captured. Option B is correct because Audit (Premium) capabilities are licensed through Microsoft 365 E5/A5 (or the E5/A5 Compliance add-on) assigned to each user whose premium audit data is generated. Option C is not required because audit records are stored in Microsoft's service, not in a customer Azure subscription. Option D is not required because Power BI Pro is unrelated to audit ingestion or retention. Option E is not required because Microsoft Sentinel is a separate SIEM product and is not a prerequisite for Audit (Premium).
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.