Question

A compliance investigator at Contoso needs to determine which user accessed a specific highly confidential file stored in SharePoint Online, when it was accessed, and from which IP address, going back 9 months. The organization has Microsoft 365 E5 licensing. Which Purview capability should the investigator use to retrieve this historical activity?

Accepted Answer

Run a search in Purview Audit (Premium), which retains audit logs for E5 users for one year and captures file access events with user, timestamp, and IP details

Answer

Use Activity explorer, filtering on the file's sensitivity label to view all access events over the past 9 months

Answer

Create an Microsoft Purview eDiscovery case and place the SharePoint site on hold to reconstruct the access history

Answer

Open a Defender for Cloud Apps file policy alert to view the access history for the file