Question

A financial services organization must satisfy a regulatory requirement that all administrative and user activity across Microsoft 365 be retained for one year and be programmatically retrievable by their in-house forensic tooling. The security architect wants a supported, forward-looking design that avoids deprecated interfaces and ensures the retention duration meets the regulator's mandate without extra licensing beyond E5. Which design should the architect recommend?

Accepted Answer

Enable Purview Audit (Premium) to obtain the one-year default retention for E5 users, and have the forensic tooling retrieve records via the Office 365 Management Activity API.

Answer

Rely on Purview Audit (Standard) 180-day retention and export logs monthly to an on-premises file share for the forensic tooling to parse.

Answer

Configure a Sentinel workspace with the Microsoft 365 connector and set the analytics-tier retention to one year, then query it with the deprecated Search-UnifiedAuditLog cmdlet.

Answer

Enable Purview Audit (Standard) and create an audit retention policy for one year, retrieving data through the Exchange Online Search-MailboxAuditLog cmdlet.