A security analyst needs to investigate a suspected account compromise by reviewing what a user did across Exchange Online and SharePoint Online over the past week. The analyst wants the activity trail, including the operation name, the timestamp, and the target object for each action, and intends to filter the results by user and by activity type. The tenant has the default Microsoft Purview Audit (Standard) configuration. Which Microsoft Purview Audit capability should the analyst use to retrieve this cross-workload activity trail?
- ACreate a Content Search in Microsoft Purview, scoping the search to the user's mailbox and OneDrive with a keyword that matches the suspicious actions.
- BQuery the Microsoft Graph activity logs to read the per-request HTTP telemetry that the user's Microsoft 365 apps generated during the period of interest.
- COpen an eDiscovery (Premium) case and add the user as a custodian to collect the audit activity for review and legal hold.
- DRun an audit search in Microsoft Purview Audit against the unified audit log, filtering by the user, the date range, and the activities of interest. Correct
Why A is wrong: Content Search finds and exports item contents such as messages and documents, but it does not return an audit trail of operations, timestamps, and target objects, so it cannot answer what the user did.
Why B is wrong: Microsoft Graph activity logs capture API request-level telemetry from applications calling Graph, not the user-facing Exchange and SharePoint operations recorded as audited activities, so they do not give this activity trail.
Why C is wrong: eDiscovery (Premium) preserves and collects content for legal matters and custodian management, which is heavier than needed and still does not produce the operation-level audit trail an audit search returns.
Why D is correct: Microsoft Purview Audit records operations from Exchange Online, SharePoint Online, and other workloads in the unified audit log, and an audit search filtered by user, date, and activity returns exactly this cross-workload activity trail.