Domain 2 of 3 · Chapter 3 of 3

Investigate Microsoft 365 activities to identify threats

Unlock the complete study guide + 25 practice exams totaling 1,498 questions.

Bundled into the existing Microsoft Certified: Security Operations Analyst Associate premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Three evidence sources for Microsoft 365 activity
  • What a Purview Audit record captures
  • Building an audit log search
  • Audit search jobs, results, and export
  • When an audit record can be found
  • Audit search from PowerShell and the API
  • Content search in the eDiscovery case model
  • Searching is not collecting or preserving
  • Where Microsoft 365 content lives for a search
  • KeyQL syntax: how a query is parsed
  • Conditions that target the right field
  • Validating a search: statistics, samples, and indexing
  • Turning on Microsoft Graph activity logs
  • Reading a MicrosoftGraphActivityLogs record
  • KQL patterns for Graph activity investigations
  • Patterns and traps for Purview Audit, Content search, and Graph activity logs

Purview Audit vs Content search vs Graph activity logs

AspectPurview AuditContent searchGraph activity logs
Question it answersWho did what to which item, and when?What do the messages and files say, and where are they?Which requests did an app or account send to Microsoft Graph?
Unit of evidenceAudit record: activity, user, date, IP address, itemIn-place items: email, documents, chats, Copilot interactionsOne row per HTTP request in MicrosoftGraphActivityLogs
Where you run itAudit search in the Purview portal, or Search-UnifiedAuditLogA search in an eDiscovery case or the Content Search caseKQL in the Log Analytics workspace the diagnostic setting targets
How far backUp to 180 days per search; retention 180 days or 1 year by defaultCurrent in-place content of the selected sourcesCollected records still retained at the configured destination, subject to its retention settings
Typical delay60 to 90 minutes for core services, not guaranteedNewly ingested items can take time to be indexedUsually within 30 minutes, sometimes up to 2 hours
Known blind spotsKeyword search skips audit data; scoped admins see only their unitsSharePoint Recycle Bin, on-premises mailboxes, partially indexed itemsRequests against other tenants' resources
Access neededAudit Logs or View-Only Audit Logs roleeDiscovery role plus case membershipRead access to the log destination

Decision tree

Need the text ofmessages or files?YesContent searchin a caseNoNeed each APIrequest an app made?YesGraph activitylogsNoActivity withinaudit retention?YesPurview Auditwho, what, whenNoRecords expireda 10-year policyis not retroactiveAlways: empty result? Checkthe delay and the source scope
Cheat sheet

Cheat sheet

  • Audit search identifies who acted on an item and what they did
  • Audit search permissions depend on the interface used
  • An audit search window is limited independently of log retention
  • Audit operation filters require exact operation names
  • Audit keyword search does not inspect every nested audit payload field
  • Audit search jobs continue without an open browser
  • Search-UnifiedAuditLog provides audit investigation outside the portal
  • Audit search filters separate the actor, service, record category, and affected resource
  • Audit evidence retention depends on the user license and workload
  • Extending audit retention does not recreate or redate existing evidence
  • Verify unified audit ingestion in Exchange Online PowerShell
  • Recent activity may not yet be available in an audit search
  • Audit export limits differ between Standard and Premium
  • Restricted audit administrators cannot see every non-user event
  • Deleting an audit search job removes results rather than audit records
  • Sent and Received conditions avoid imported-email ambiguity in date filtering
  • eDiscovery keywords are always case-insensitive
  • eDiscovery wildcard matching supports prefixes rather than arbitrary substrings
  • A space after the property colon changes a targeted search into full-text matching
  • Quote multiword values to keep the full phrase inside the property restriction
  • A trailing slash prevents a site path search from including similarly named sites
  • Explicit KeyQL operators distinguish required terms, alternatives, exclusions, and proximity
  • Participants includes the sender while Recipients and To narrow the recipient scope
  • The kind property filters communication types rather than words describing them
  • Document Title searches Office metadata rather than the file name
  • Created and Last modified select different document events
  • Content Search is performed within the eDiscovery case experience
  • An empty content query collects all content in the selected sources
  • Statistics and sample results support query validation before collection or export
  • Including partially indexed items in search does not automatically include them in export
  • Duplicating a search preserves the original query while allowing refinement
  • Display timezone changes do not alter eDiscovery search timestamps
  • Content Search visibility is controlled by eDiscovery permissions and case membership
  • Searching, copying to a review set, and preserving source content are different operations
  • An empty content search can reflect unsupported storage or unindexed deleted content
  • Teams message evidence and shared files require different search locations
  • Advanced indexing reprocesses content so search conditions can evaluate it
  • Source searches and review-set image searches use separate OCR settings
  • The query keywords report identifies terms driving search hits
  • Copilot prompts and responses are mailbox evidence for eDiscovery
  • Graph activity logs expose API requests rather than only sign-ins
  • Graph caller attribution can require the application, service principal, and user together
  • Graph batch members share an operation identifier but have their own request identifiers
  • ClientAuthMethod distinguishes public clients, secrets, and certificates
  • Graph token claims and tenant-wide user roles are recorded separately
  • Graph activity logging is limited to the resource tenant
  • Graph request provenance separates token issuance from API use
  • Count distinct failed Graph requests after filtering the resource and status codes
  • Risky-user correlation joins Graph UserId to the risk report's Id
  • Graph sign-in correlation uses the sign-in activity identifier against token identifiers
  • HTTP 429 identifies throttled Graph requests for caller analysis
  • Graph activity evidence must be enabled and routed before it can be investigated
  • Graph activity log delivery can lag behind the request
  • Time-binned Graph request counts reveal changes hidden by caller totals

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://learn.microsoft.com/en-us/purview/audit-log-investigate-accounts
  2. https://learn.microsoft.com/en-us/purview/audit-solutions-overview
  3. https://learn.microsoft.com/en-us/purview/edisc
  4. https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview
  5. https://learn.microsoft.com/en-us/defender-xdr/incidents-overview
  6. https://learn.microsoft.com/en-us/defender-xdr/m365d-action-center
  7. https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview
  8. https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-graphapiauditevents-table
  9. https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/microsoftgraphactivitylogs
  10. https://learn.microsoft.com/en-us/purview/audit-search
  11. https://learn.microsoft.com/en-us/purview/audit-log-export-records
  12. https://learn.microsoft.com/en-us/purview/audit-log-activities
  13. https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema
  14. https://learn.microsoft.com/en-us/purview/audit-log-retention-policies
  15. https://learn.microsoft.com/en-us/powershell/module/exchange/search-unifiedauditlog
  16. https://learn.microsoft.com/en-us/purview/ediscovery
  17. https://learn.microsoft.com/en-us/purview/edisc-search-query
  18. https://learn.microsoft.com/en-us/purview/edisc-permissions
  19. https://learn.microsoft.com/en-us/purview/edisc-search-results
  20. https://learn.microsoft.com/en-us/purview/edisc-hold-create
  21. https://learn.microsoft.com/en-us/purview/edisc-search-teams
  22. https://learn.microsoft.com/en-us/purview/edisc-search-mailboxes
  23. https://learn.microsoft.com/en-us/purview/edisc-keyword-query-language
  24. https://learn.microsoft.com/en-us/purview/edisc-condition-builder
  25. https://learn.microsoft.com/en-us/purview/edisc-search-sites
  26. https://learn.microsoft.com/en-us/purview/edisc-ref-advanced-indexing
  27. https://learn.microsoft.com/en-us/purview/edisc-settings-search-analytics
  28. https://learn.microsoft.com/en-us/entra/identity-platform/access-token-claims-reference