Question

A financial services company must comply with a regulation requiring that all administrator activities on privileged Exchange Online mailboxes be retained for 10 years and be searchable within minutes for regulatory investigations. The security architect must design the logging capability. Auditors will also request evidence that specific high-value user activities (like MailItemsAccessed) were captured. Which combination of Microsoft Purview Audit capabilities best meets these requirements?

Accepted Answer

Enable Audit (Premium), apply a 10-year audit log retention policy scoped to the privileged mailbox activities, and rely on Premium's high-value events like MailItemsAccessed

Answer

Use Audit (Standard) with the default 180-day retention and export logs manually to a spreadsheet before they expire

Answer

Configure Azure Monitor diagnostic settings on the Exchange servers to forward mailbox logs to a Log Analytics workspace with 10-year retention

Answer

Enable Microsoft Sentinel data connectors for Office 365 and set the Analytics tier retention to 10 years, ignoring the Purview Audit configuration