Microsoft · SC-200
Microsoft 365 activities
SC-200 · Lesson 12 of 14 · 1:18:03
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-200 exam (Microsoft Certified: Security Operations Analyst Associate). In this lesson: Microsoft Purview Audit Standard (180 days, search tool, Search-UnifiedAuditLog) and Premium (one year, ten years with an add-on, intelligent insights), Content search in the new eDiscovery experience, and Microsoft Graph activity logs (diagnostic settings, Entra ID P1 or P2, the MicrosoftGraphActivityLogs table). Includes three original practice questions.
Preview the topics
- An investigation needs mailbox audit records from ten months ago, and the organization only has Audit Standard. Can it find them?
- After a phishing incident, the legal team needs a copy of every message with a specific subject line, across all mailboxes. What should the investigator use?
- The team suspects that an attacker used a stolen app token to read mailboxes through Microsoft Graph. Which source shows those API calls?