Searches the unified audit log for admin and user activity across Microsoft services. The Standard tier keeps records for 180 days, while Premium adds longer retention and intelligent insights.
Also called Purview Audit.
Read more: Microsoft Learn
In the Ultra Transcenders books
SC-500AB-900SC-200DP-700SC-401
Each book explains Microsoft Purview Audit in context, with comparison tables and the common traps.
Terms in this definition
- Unified audit log
A record of what users and administrators do across numerous Microsoft 365 services, which can be searched with Microsoft Purview Audit. For core services, entries typically become available between one hour and an hour and a half after the activity.
- Chat message roles
Labels on chat messages: instructions go under system, the person's input under user, the model's previous answers under assistant, and results returned by a called tool under tool (or function).
- S0 pricing tier (Foundry Tools)
Name of the standard paid tier for Foundry, Azure OpenAI and most Foundry Tools. Exceptions: Computer Vision calls its standard tier S1, and Document Intelligence offers nothing beyond F0 and S0.
- Premium
Hosting plan for Azure Functions that keeps instances pre-warmed to avoid cold starts and supports VNet integration. Executions time out after 30 minutes by default, which host.json can extend.
- Intelligent insights
Extra-valuable audit records that Microsoft Purview Audit (Premium) captures to support forensic and compliance investigations into a possible breach, for example around access to mail items.
Related terms
- CloudAppEvents
Holds enriched activity from Office 365 and connected SaaS apps for advanced hunting. Data arrives only through Defender for Cloud Apps and its Microsoft 365 connector; Purview Audit by itself doesn't fill it.