Extra-valuable audit records that Microsoft Purview Audit (Premium) captures to support forensic and compliance investigations into a possible breach, for example around access to mail items.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Intelligent insights in context, with comparison tables and the common traps.
Terms in this definition
- Audit
Policy effect that lets a request proceed but flags the resource as non-compliant and logs a warning to the activity log. Microsoft suggests beginning there and later moving to something enforcing, like Deny.
- Microsoft Purview Audit
Searches the unified audit log for admin and user activity across Microsoft services. The Standard tier keeps records for 180 days, while Premium adds longer retention and intelligent insights.
- Premium
Hosting plan for Azure Functions that keeps instances pre-warmed to avoid cold starts and supports VNet integration. Executions time out after 30 minutes by default, which host.json can extend.
Related terms
- Microsoft 365 Advanced Auditing
Found in a user's Licenses and apps settings, this service plan has to be switched on, alongside a qualifying licence, before Audit (Premium) events such as intelligent insights get recorded.
- Microsoft Purview Audit (Premium)
Higher audit tier that retains SharePoint, OneDrive, Exchange and Entra ID records for a year and offers intelligent insights like MailItemsAccessed, plus retention policies reaching 10 years with an add-on.
- Microsoft Purview Audit (Standard)
Unified audit log tier you get by default, keeping records for 180 days; custom retention policies and intelligent insights aren't included.