Question

During an incident investigation, a SOC analyst needs to determine whether a specific user accessed a set of SharePoint documents 200 days ago. The organization has Microsoft 365 E5 licensing. When the analyst runs an Audit (Standard) search in Microsoft Purview, no results appear for the file access events from that period. What is the MOST likely reason and the correct action to retrieve the needed data?

Accepted Answer

Audit (Standard) retains logs for 180 days; the analyst should use Audit (Premium), which retains audit records for one year (or longer with an add-on), and rerun the search within that retention window.

Answer

SharePoint file access events are never captured by unified auditing; the analyst must instead enable SharePoint diagnostic logging on the server and re-collect the logs.

Answer

The analyst should submit an eDiscovery (Premium) hold to force Purview to regenerate the missing audit records from the 200-day-old period.

Answer

Audit logging must be manually turned on per user before any events are recorded; because it was off, the historical events cannot be recovered by any method.