SC-401 - Audit and Alerts

Audit Overview

Microsoft Purview Audit provides a unified audit log that captures user and admin activities across Microsoft 365 services. It enables security investigations, compliance reporting, and forensic analysis of what happened, when, and by whom in your Microsoft 365 environment.

Audit log captures activities across:

• Exchange Online (email access, mailbox changes, admin operations)
• SharePoint Online and OneDrive (file access, sharing, permissions changes)
• Microsoft Teams (channel messages, meeting creation, app additions)
• Azure Active Directory / Microsoft Entra ID (sign-ins, role changes, app registrations)
• Microsoft 365 Defender portal (alert actions, policy changes)
• Microsoft Purview (DLP matches, label activities, eDiscovery actions)
• Power BI, Power Platform, Dynamics 365

Audit (Standard)

Audit (Standard) is the base tier available with Microsoft 365 E3/Business Premium and above.

Key Standard activities available: FileAccessed, FileModified, FileMoved, FileShared, FileDeleted, Sent (Exchange), MailboxLogin, UserLoggedIn, AddMember (Groups), and hundreds more.

Audit (Premium)

Audit (Premium) extends Standard with additional high-value events, longer retention, and custom retention policies for forensic investigations.

Key Audit (Premium) Events

Audit Log Retention Policies

Audit (Premium) allows creating custom audit log retention policies to retain specific audit records for longer than the default period, or to retain records for specific workloads, users, or activity types.

Retention Policy Configuration

Default Policy Behavior

Audit (Premium) includes a built-in default retention policy covering all activities for Premium-licensed users:

• Users with E5 or Compliance add-on: 1-year default retention
• Users with only E3: 180-day retention (Standard tier)
• Custom policies override the default for matching records

Searching and Exporting Audit Logs

Using Audit Search in the Purview Portal

1. Navigate to Microsoft Purview compliance portal - Audit
2. Set the date range (up to 90 days per search for Standard; 1 year or more for Premium)
3. Optionally filter by: Activities (specific event types), Users, File/folder/site, IP address, Record type
4. Click Search and wait for results (large searches may take minutes)
5. Export results to CSV for offline analysis (up to 50,000 records per export)

Audit Search via PowerShell

For programmatic access and searches returning more than 50,000 records, use Exchange Online PowerShell:

• Search-UnifiedAuditLog - search audit log with filtering by date, operations, users
• Use -ResultSize and pagination via -SessionId and -SessionCommand ReturnLargeSet for large result sets
• Use the Office 365 Management Activity API for SIEM integration (Microsoft Sentinel, Splunk, etc.)

Required Roles for Audit Search

To search audit logs, users need one of:

• Audit Logs role in Microsoft Purview compliance portal (can search and export)
• View-Only Audit Logs role (can search and view, but not export in all cases)
• Global Administrator, Compliance Administrator - have Audit Logs role by default

DLP Alerts

DLP policies can be configured to generate alerts when policy rules are matched, enabling active monitoring and incident response for data protection violations.

DLP Alert Configuration

Within each DLP policy rule, configure incident reports and alerts:

• Alert every time a rule matches: Generates individual alerts for each match event (can create high volume for active policies)
• Aggregate events into a single alert: Groups multiple matches within a time window into one alert (reduces alert fatigue)
• Alert threshold: Set minimum activity count before alert triggers
• Severity level: Low, Medium, High - used for prioritization in alert dashboards
• Email notifications: Send incident reports to specified email addresses when rule matches

DLP Alerts Dashboard

The DLP Alerts dashboard in the Purview compliance portal shows all DLP alert events with:

• Alert severity and status (Active, Investigating, Resolved, Dismissed)
• Activity details: which rule matched, user, file/message details, timestamp
• Evidence details: matched content with highlighted sensitive information
• User activity history: other recent DLP matches for the same user
• Case creation: ability to create an eDiscovery case directly from the DLP alert for further investigation

Defender XDR Alerts

Microsoft Defender XDR (Extended Detection and Response) consolidates security alerts from multiple Microsoft security products into unified incidents. For SC-401, key alert types include:

Investigating Data-Related Incidents in Defender XDR

When a DLP alert or MDCA data alert becomes a Defender XDR incident:

1. The incident appears in Defender XDR Incidents queue with affected users, assets, and evidence
2. Related alerts from other products (e.g., Entra risky sign-in + DLP violation by same user) are automatically correlated
3. Advanced Hunting (KQL queries) can correlate audit events, DLP events, and endpoint signals for deep investigation
4. Automated investigation and response (AIR) may suggest or automatically take remediation actions

Content Search and eDiscovery

Content Search and eDiscovery tools allow searching across Microsoft 365 content for legal holds, investigations, and regulatory requests.

Tool Comparison

KQL in Content Search

Content Search supports Keyword Query Language (KQL) for precise targeting:

• subject:"Project X" - search by email subject
• from:user@company.com - search by sender
• sent:2023-01-01..2024-01-01 - date range filter
• kind:email AND confidential - content type plus keyword
• SensitivityLabel:"Highly Confidential" - search by sensitivity label