Question

A security analyst at your organization needs to search through user and admin activity logs from Exchange, SharePoint, and Microsoft Entra ID to investigate a suspected incident. The organization currently uses Microsoft Purview Audit (Standard). Which statement correctly describes what Audit (Standard) provides in this situation?

Accepted Answer

It records and retains audit logs of user and admin activity that can be searched to support investigations.

Answer

It automatically applies retention labels to any content identified during the investigation.

Answer

It blocks users from sharing sensitive data externally while the investigation is ongoing.

Answer

It preserves mailbox content on legal hold so it cannot be deleted during litigation.