Respond to security incidents
Microsoft 365 Activity Investigation
ImportantChoose among Purview Audit, eDiscovery Content search, and Microsoft Graph activity logs according to whether the investigation asks about actions, stored content, or Graph API requests.
Aligned to SC-200 skills measured as of July 28, 2026; product behavior verified September 18, 2026.
Why this matters
These sources overlap in users and workloads but answer different questions. Searching document content cannot reliably identify who changed a role, and an administrative audit event does not locate every stored copy of a leaked design.
Must Know
- Purview Audit searches supported user and administrator operations by workload, operation, actor, target, result, and UTC time range.
- eDiscovery Content search locates items in supported Exchange, SharePoint, OneDrive, Teams, and other custodial locations.
- Microsoft Graph activity logs record Graph requests and include caller, request, response, and timing context useful for app investigations.
- Correlate content location with audit activity when a case asks both what data exists and who accessed or shared it.
Compare and Distinguish
- Purview Audit answers who performed which recorded operation and when; eDiscovery Content search locates content in supported data locations.
- Graph activity logs record requests made to Microsoft Graph; they do not replace workload audit records or content search.
- A content hit establishes that data matches the search; it does not by itself establish that a user performed a malicious action.
Scenario examples
- Scenario: Determine who changed a sharing setting. Think: search Purview Audit by operation, user, workload, and time.
- Scenario: Find messages containing a known campaign indicator. Think: use eDiscovery Content search across the appropriate locations.
- Scenario: Identify an application making unusual Graph calls. Think: query Microsoft Graph activity logs and correlate identity context.
Exam traps
- Content search returns matching items; it does not by itself identify the actor who downloaded them.
- A narrow or misaligned UTC window can make a valid audit operation appear absent.
- Endpoint telemetry is not the authoritative record of every Microsoft 365 administrative action.
- A string of Graph 403 responses followed by success may indicate a permission change that needs an audit pivot.
Key takeaways
- Use Audit for actions, Content search for stored items, and Graph activity logs for API calls.
- Preserve actor, target, result, workload, and time context when reconstructing activity.
- Combine sources when the investigation crosses content, administration, and application access.
How it works
- Purview Audit records supported operations with actor, target, workload, result, and time details.
- Content search indexes stored items in selected locations; Graph activity logs describe calls made to Microsoft Graph.
Objects and administrative surfaces
- Microsoft Purview portal Audit search for activity records.
- Microsoft Purview eDiscovery Content search for mailboxes, sites, and supported content locations.
- Azure Monitor destination used for Microsoft Graph activity logs.
When to use it
- Use Content search to locate messages and documents across custodian locations.
- Use Audit or Graph logs to attribute supported user, administrator, or application activity.
Security and governance implications
- Limit eDiscovery cases and search exports to authorized investigators.
- Preserve audit results and API caller identifiers before changing an account or application.
Troubleshooting signals
- Expand the time range and verify workload, operation, and actor filters before concluding an audit event is absent.
- For Graph failures followed by success, correlate application identity and the permission-consent audit event.
More detail
- Purview Audit searches supported user and administrator operations by workload, operation, actor, target, result, and UTC time range.
- eDiscovery Content search locates items in supported Exchange, SharePoint, OneDrive, Teams, and other custodial locations.
- Microsoft Graph activity logs record Graph requests and include caller, request, response, and timing context useful for app investigations.
- Correlate content location with audit activity when a case asks both what data exists and who accessed or shared it.
Ready for the quiz?
- Which source identifies who assigned a role?
- Which source locates every mailbox and site copy of a phrase?
- What should be correlated when a Graph app changes from denied to successful calls?
Related objectives
- D2.3.S1 — Investigate threats by using Microsoft Purview Audit
- D2.3.S2 — Investigate threats by using Content search in Microsoft Purview eDiscovery
- D2.3.S3 — Investigate threats by using Microsoft Graph activity logs