What should you use?

Your company has a Microsoft 365 subscription.

You need to identify which users performed the following privileged administration tasks:

– Deleted a folder from the second-stage Recycle Bin if Microsoft SharePoint

– Opened a mailbox of which the user was not the owner

– Reset a user password

What should you use?
A . Microsoft Azure Active Directory (Azure AD) audit logs
B . Microsoft Azure Active Directory (Azure AD) sign-ins
C . Security & Compliance content search
D . Security & Compliance audit log search

View Answer

Answer: A

Explanation:

You can view the required information in the audit logs. The Azure AD audit logs provide records of system activities for compliance. To access the audit report, select Audit logs in the Activity section of Azure Active Directory.

Reference: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-audit-logs