Purview Audit: The Forensic Black Box — Purview: Insider Risk and Compliance

Every serious investigation reaches the same uncomfortable moment: someone asks what actually happened, and memory is no longer good enough. Microsoft Purview Audit is the record you turn to when a document was exposed, a mailbox rule appeared, a privileged setting changed, or a Copilot answer raised a concern. It is not glamorous, and it is not a substitute for prevention, but it is one of the most important controls in Microsoft 365 because it preserves the facts that let security, compliance, legal, and operations teams reconstruct events after the damage, dispute, or suspicion begins.

What Purview Audit is for

Microsoft Purview Audit is the auditing capability for Microsoft 365 activity. It captures user and administrator operations from Microsoft services into a unified audit log: files opened, permissions changed, mailbox rules created, messages accessed, passwords reset, sharing links generated, and many other events.

The point is simple: when a person, service, or administrator takes an action, the organization needs a durable record of that action. In an investigation, that record helps answer who acted, what they did, when they did it, which service was involved, and often where the activity came from, such as an internet protocol address, which is a numeric network address used to identify a device or connection.

This makes Audit a forensic black box, with one important caveat. An aircraft black box is built in before the crash. Audit must also be enabled, licensed, retained, and operational before the incident. If the relevant records have already aged out, no later investigation can recreate them with certainty.

The unified audit log

The unified audit log is the central record of audited operations across Microsoft 365 services. Rather than forcing investigators to learn a separate log for every application, it gives them one searchable place to start.

A single audit event usually contains a timestamp, the user or administrator involved, the operation performed, the workload or service, the affected object, and technical details that help narrow the investigation. Depending on the event, that object might be a document, a mailbox, a site, a policy, a group, or a Copilot interaction.

This unification matters because incidents rarely stay inside one product boundary. A suspicious account might sign in, open files, create an inbox rule, change sharing permissions, and use a collaboration tool in the same hour. If those events live in unrelated systems with different retention windows and search methods, the investigation becomes slower and less reliable.

📌

Start with time. Most audit investigations become easier when you first define the narrowest credible time window and then expand only when the evidence requires it.

One searchable log collects audited events from many Microsoft 365 services.

Standard Audit and Audit Premium

There are two tiers to understand: Standard Audit and Audit Premium. Standard Audit gives organizations a useful baseline for common operational and compliance questions. It can help answer recent questions such as who deleted a file, who changed a permission, or who created a mailbox rule.

Audit Premium is designed for deeper and longer investigations. It extends audit retention significantly, with up to one year of default retention for eligible users and longer retention available through additional licensing or add-ons. It also provides more detailed events and capabilities that matter when an investigation is no longer routine.

The practical difference is not just cost or terminology. It is the difference between asking a question while the evidence still exists and asking it after the standard retention window has expired. Many real incidents are discovered late: a compromised mailbox from three months ago, suspicious file access during a merger, or an insider concern that only becomes visible after a business dispute. Those cases need longer retention and richer detail.

⚠️

Retention is perishable. Audit data that has aged out of retention cannot be recovered later simply by buying a higher tier after the incident.

Audit Premium extends retention and detail beyond the Standard baseline.

What forensic detail changes

Forensic investigations need more than a broad statement that something happened. They often need the sequence, the affected object, the user, and the surrounding context. Audit Premium adds the kind of detail that helps investigators move from suspicion to a defensible timeline.

Examples include mail read events, specific file access records, and permission changes. Those details can be decisive. It is one thing to know that a user had access to a mailbox; it is another to know whether messages were actually read. It is one thing to know a confidential file existed in a shared site; it is another to know who accessed it during a sensitive period.

This detail also helps reduce false conclusions. Many investigations begin with an alarming signal, but the audit trail may show a legitimate administrator action, an automated service, or a user mistake rather than malicious behavior. Good evidence does not always prove wrongdoing; sometimes its value is proving that a feared event did not occur.

Mail activity can help distinguish mailbox access from actual message reading.
File activity can show whether sensitive documents were opened, shared, downloaded, or modified.
Permission activity can reveal when access was expanded, reduced, or delegated.
Administrator activity can connect configuration changes to a named account and time.
Artificial intelligence activity can show prompts, referenced content, and agent-related actions where supported.

Auditing Copilot and artificial intelligence applications

Microsoft Purview Audit now extends to Copilot and artificial intelligence applications. This is an important shift because artificial intelligence systems do not only store content; they interpret, summarize, retrieve, and generate. Investigators therefore need evidence about the interaction, not just the underlying files.

For Microsoft 365 Copilot and supported artificial intelligence applications, audit records can include prompts a user typed, files an agent or assistant referenced while generating a response, and related artificial intelligence application activity. The significance is not merely that these events are logged. It is that they are captured in the same unified audit log that investigators already use for other Microsoft 365 activity.

That consistency matters. If a Copilot response appears to disclose more than intended, the team should not have to build a separate artificial intelligence forensics process from scratch. They can search the audit log, correlate the interaction with file permissions and access history, and ask whether the response followed the permissions and data available to that user or agent at the time.

Audit captures the prompts, referenced files, and AI activity behind a response.

How an investigation actually uses Audit

A good audit investigation is a disciplined reconstruction, not a keyword hunt. The investigator starts with a question, such as whether a sensitive file was accessed by an unauthorized person, whether a mailbox was manipulated after account compromise, or whether a Copilot response relied on a restricted document.

The next step is to frame the time window and identify the people, groups, devices, sites, mailboxes, or documents involved. Audit search can then return relevant events, which are sorted into a timeline. That timeline is compared with identity records, endpoint alerts, data loss prevention events, eDiscovery collections, or security information and event management data. A security information and event management system, often called a SIEM, is a platform that collects and correlates security logs from many sources.

The best outcome is not a pile of raw logs. It is a narrative supported by evidence: this account signed in, these permissions changed, these files were accessed, this mailbox rule was created, this Copilot prompt was submitted, and this response referenced these materials. The narrative must be specific enough for technical remediation and clear enough for legal, compliance, and executive review.

An investigation frames a question, scopes time, searches, then builds a timeline.

The decisions leaders and practitioners must make

Audit is not only a technical feature. It is a risk decision. Leaders decide how much evidence the organization must preserve, how long it must be retained, who is allowed to search it, and what kinds of investigations justify access to sensitive audit records.

Practitioners translate those decisions into configuration and operations. They confirm that auditing is enabled, assign the right licenses, validate that high-value users and workloads are covered, document retention requirements, and test searches before there is an emergency. They also decide how audit records will be exported, reviewed, protected, and correlated with other security tools.

The hardest trade-off is often between cost, privacy, and investigative readiness. More detailed and longer-retained logs improve investigations, but they also increase the responsibility to govern access carefully. Audit records can reveal sensitive behavior, including what people read, searched for, or asked an artificial intelligence assistant. That evidence must be protected with the same seriousness as the content it describes.

Which users, roles, and workloads require Audit Premium because their activity creates high business risk?
How long must audit records be retained for security, legal, regulatory, and contractual obligations?
Who can run audit searches, approve sensitive searches, and export results?
How will audit evidence be preserved when an investigation becomes a legal or compliance matter?
How often will the organization test that the expected events are actually being captured?

Limits and operating discipline

Audit is powerful, but it is not magic. It does not prevent the action from happening. It does not guarantee that every event contains every detail an investigator might want. It does not fix weak permissions, excessive sharing, or poor identity controls. Its job is to record evidence, not to replace prevention and detection.

It also requires operational discipline. Someone must know how to search the log, interpret event names, handle time zones, preserve exports, and explain the limits of the evidence. In a high-pressure investigation, small mistakes can matter: searching the wrong date range, overlooking service account activity, or confusing access permission with actual access.

The right pattern is to treat Audit as part of a wider evidence system. Identity logs explain sign-ins and authentication. Endpoint tools explain device behavior. Data loss prevention tools explain policy matches and attempted sharing. eDiscovery handles legal collection and review. Audit connects those sources to concrete user and administrator actions inside Microsoft 365.

✅

Practice before crisis. Run a small audit drill each quarter so investigators know which events appear, how long searches take, and where the gaps are.

Key takeaways

Microsoft Purview Audit records user and administrator activity across Microsoft 365 in a unified audit log.
Standard Audit is useful for recent operational questions, while Audit Premium provides longer retention and richer forensic detail.
Audit Premium can retain records for up to one year by default for eligible users, with longer retention available through additional options.
Copilot and supported artificial intelligence application activity can be captured in the same audit log, including prompts, referenced files, and agent-related actions where supported.
Audit must be enabled, licensed, and tested before an incident because expired audit data cannot be recreated later.
Audit evidence is most valuable when investigators turn raw events into a clear, time-ordered narrative that supports decisions.

Glossary

Microsoft Purview Audit: The Microsoft Purview capability that records user and administrator activity across Microsoft 365 services for investigation and compliance.
Unified audit log: The central searchable log that stores audited operations from multiple Microsoft 365 services.
Standard Audit: The baseline Microsoft 365 auditing tier used for common and recent operational investigation questions.
Audit Premium: The enhanced auditing tier that provides longer retention and more detailed forensic events for eligible users and workloads.
Forensic investigation: A detailed after-the-fact analysis that reconstructs what happened during a security, compliance, legal, or operational incident.
Copilot: Microsoft's artificial intelligence assistant experience that can answer, summarize, generate, and reason over permitted Microsoft 365 content.
Artificial intelligence: Software capability that performs tasks such as summarizing, generating, classifying, or reasoning over information in ways that resemble human cognitive work.
SIEM: A security information and event management system that collects and correlates security logs from many sources.