Question

A financial services company must meet a new regulatory requirement mandating that they retain forensic audit logs for at least one year and be able to determine which specific mail items a compromised account accessed during a breach. They currently rely on the default Microsoft Purview Audit (Standard) configuration with E3 licensing. As the cybersecurity architect, what is the MINIMUM change you should recommend to satisfy both requirements while avoiding unnecessary licensing costs?

Accepted Answer

Upgrade to Audit (Premium) via E5 or the appropriate add-on to gain the one-year default retention and the MailItemsAccessed forensic event

Answer

Keep Audit (Standard) but configure a custom audit log retention policy to extend retention to 365 days

Answer

Forward all audit events to Microsoft Sentinel and rely on Sentinel's Analytics tier retention to meet the one-year requirement

Answer

Enable Azure Storage immutable blob retention and export audit logs there while keeping Audit (Standard)