Question

A financial services company must comply with a regulation requiring that all mailbox access events, including which specific mail items were read, be retained for one year to support forensic investigation of potential insider data theft. The security architect discovers that with the current Microsoft 365 E3 licensing, investigators can see that a user signed in but cannot determine which individual emails were accessed, and audit logs are only retained for 90 days. Which change should the architect recommend to meet the requirement with the least custom engineering?

Accepted Answer

Enable Microsoft Purview Audit (Premium) to gain access to crucial events such as MailItemsAccessed and configure an audit log retention policy for one year

Answer

Configure a Microsoft Sentinel data connector to ingest Office 365 sign-in logs and set the Log Analytics workspace retention to 365 days

Answer

Deploy a Microsoft Purview data loss prevention (DLP) policy scoped to Exchange Online to block and log all outbound email containing sensitive data

Answer

Enable Microsoft Defender for Office 365 Plan 2 and use Threat Explorer to review email access telemetry for the affected mailboxes