Module 6 of 6 — Final

🔐 Purview Course · Module 6 of 6 · Final

eDiscovery, Audit & Insider Risk Management

📂 Course: Compliance & Purview Administration
📦 Module: 6 of 6 — Final
🎯 Exam: SC-400
⏱ Read time: ~26 min

SC-400 Exam Alignment
SC-400

Skills: Implement and manage eDiscovery · Implement and manage audit · Implement insider risk management — Run Content Search and eDiscovery cases, manage custodians in eDiscovery Premium, search and export the Unified Audit Log, configure Audit Premium, create Insider Risk Management policies, and deploy Communication Compliance policies.

Know the three eDiscovery tools in order of complexity: Content Search (ad hoc, no case) → eDiscovery Standard (case-based, hold + export) → eDiscovery Premium (custodian management, review sets, advanced analytics)
Understand that Audit (Standard) retains events for 90 days (E3); Audit Premium (E5) retains up to 10 years and adds high-bandwidth API access and critical event logging
Insider Risk Management policies use a combination of Microsoft 365 activity signals, HR connector data, and DLP alerts to identify at-risk user behaviour
Communication Compliance scans Teams, Exchange, and Viva Engage messages — requires separate reviewer role assignment

Exam Tip: SC-400 tests eDiscovery privilege: the eDiscovery Manager role can only see cases they created or were added to. The eDiscovery Administrator role can see ALL cases in the tenant. This distinction appears frequently in scenario questions about who can access sensitive legal matters.

The final module of the Purview course covers the investigative and monitoring capabilities: eDiscovery to find and preserve content for legal matters, Audit to log and investigate user activity, Insider Risk Management to proactively detect risky behaviour patterns, and Communication Compliance to monitor and enforce appropriate communication policies across Microsoft 365.

🔎 Content Search

Content Search is the fastest, simplest eDiscovery tool — no case required. It searches across Exchange mailboxes, SharePoint sites, OneDrive accounts, Teams chats, Viva Engage, and Skype for Business simultaneously.

Feature	Details
Search syntax	Keyword Query Language (KQL) — boolean operators (AND, OR, NOT), date ranges, field-specific searches (subject:, from:, to:, received:, filetype:, size:)
Locations	All mailboxes, all SharePoint/OneDrive, specific users or sites, Teams messages, Viva Engage
Preview	Preview up to 1,000 items from results without exporting — check the search is finding what you expect before exporting
Export	Export results as PST (mailbox items) or native file format (SharePoint/OneDrive documents)
No hold capability	Content Search cannot place a legal hold — use eDiscovery Standard or Premium cases for hold

📂 eDiscovery Standard vs eDiscovery Premium

Feature	eDiscovery Standard	eDiscovery Premium
Licence	Microsoft 365 E3+	Microsoft 365 E5 or E5 Compliance add-on
Case management	Basic case with searches and exports	Full case with custodians, review sets, analytics
Legal hold	✅ Query-based or location-based hold	✅ Custodian-based hold — targeted to specific people
Custodian management	❌ Not available	✅ Add custodians, map to their data sources, send hold notices
Review sets	❌ Export only	✅ Add search results to a review set — annotate, tag, redact, apply privilege tags before export
Near-duplicate detection	❌	✅ Groups near-identical documents to reduce review volume
Email threading	❌	✅ Groups emails into conversation threads — review the full conversation efficiently
Predictive coding	❌	✅ Train ML model on relevant/non-relevant documents to prioritise review

eDiscovery Standard Workflow

Step	Action
1. Create case	eDiscovery → Standard → New case. Name the matter and add members (eDiscovery Managers) who can access this case.
2. Create holds	Add the relevant mailboxes and SharePoint sites to a hold — preserves content so it cannot be deleted even if users try to do so.
3. Run searches	Search the held content using KQL to find relevant documents and emails. Preview and refine.
4. Export results	Export as PST or native files. The export package includes a manifest, a results file, and the actual documents/emails.
5. Close / delete case	When the legal matter is resolved, close the case (releases holds) or delete it (removes all case data permanently).

💡 eDiscovery Manager vs eDiscovery Administrator

eDiscovery Manager: Can create cases and searches; can only see cases they created or were explicitly added to. Cannot see other managers’ cases.
eDiscovery Administrator: All eDiscovery Manager permissions PLUS can see and manage ALL cases across the tenant. Use for legal team leads or compliance officers who need tenant-wide oversight.

📋 Unified Audit Log

The Unified Audit Log (UAL) captures user and admin activity across Microsoft 365 workloads — Exchange, SharePoint, OneDrive, Teams, Entra ID, Purview, Power Platform, and more. Over 200 different activity types are recorded.

Workload	Example Activities Logged
Exchange Online	Mailbox access (by owner, delegate, admin), email sent/received, calendar events modified, mailbox settings changed
SharePoint & OneDrive	File accessed, file downloaded, file shared, file deleted, permission changes, site collection admin changes
Microsoft Teams	Channel created/deleted, meeting created, user added/removed from team, chat message sent (Teams Premium)
Entra ID	Sign-in events, MFA challenges, user created/deleted, role assigned, password changed/reset, Conditional Access policy changed
Microsoft Purview	Sensitivity label applied/changed, DLP policy matched, eDiscovery case created, retention label applied
Admin activities	Admin role assigned, service settings changed, subscription changes, Microsoft 365 admin actions

Audit Standard vs Audit Premium

Feature	Audit Standard (E3)	Audit Premium (E5)
Retention period	90 days	1 year by default; up to 10 years with Audit Premium retention policies
Critical events	Standard activity set	+ MailItemsAccessed, Send, SearchQueryInitiatedExchange, SearchQueryInitiatedSharePoint — critical for BEC investigation
API access bandwidth	Standard (60,000 requests/minute for entire org)	High bandwidth (100,000 requests/minute per app) — for SIEM integration
Audit retention policies	❌	✅ Can set custom retention periods up to 10 years per workload or activity type

PowerShell — Audit Log Search & eDiscovery

# Search the Unified Audit Log — last 7 days, SharePoint file access by specific user
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) `
  -RecordType SharePoint -Operations FileAccessed `
  -UserIds john.doe@contoso.com -ResultSize 500 |
  Select-Object CreationDate,UserIds,Operations,AuditData

# Export Exchange admin audit events for January to CSV
Search-UnifiedAuditLog -StartDate '2026-01-01' -EndDate '2026-01-31' `
  -RecordType ExchangeAdmin -ResultSize 5000 |
  Export-Csv -Path .\ExchangeAdminAudit-Jan2026.csv -NoTypeInformation

# Verify audit logging is enabled (required for UAL to capture events)
Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled

# Enable audit if not already on
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

⚠️ Insider Risk Management

Insider Risk Management (IRM) uses signals from Microsoft 365 activity, HR connectors, and DLP alerts to detect patterns of behaviour that may indicate a security or compliance risk.

Policy Templates

Policy Template	Scenario It Detects	Key Signals
Data theft by departing users	Employees copying, downloading, or emailing large volumes of data before their resignation date	HR connector (resignation date) + SharePoint downloads + email to personal accounts
General data leaks	Broad data exfiltration across all users — no HR event needed	DLP alerts + SharePoint/OneDrive downloads + USB copy + browser upload to external sites
Data leaks by priority users	Same as data leaks but scoped to high-risk users (e.g. executives, admins, finance)	Same signals as data leaks, applied to a defined priority user group
Security policy violations	Users disabling security tools, installing unapproved software, or accessing restricted resources	Defender for Endpoint signals
Offensive language	Harassment, discriminatory language, or threatening content in Teams and Exchange	Communication signals — requires Communication Compliance integration

⚠️ IRM Privacy Protections

By default, user identities are pseudonymised in the alerts dashboard — analysts see “User 12345” not the real name. Analysts must be explicitly granted the Insider Risk Management Investigators role to de-anonymise identities. Additionally, IRM only shows activity metadata — not the actual content of files or messages, unless escalated to eDiscovery.

💬 Communication Compliance

Communication Compliance monitors communications in Teams, Exchange, and Viva Engage to detect policy violations — regulatory breaches, harassment, conflicts of interest, code of conduct violations, and inappropriate content.

Policy Type	What It Monitors
Offensive language	Detects profanity, harassment, threatening language using built-in trainable classifiers and custom keyword lists
Regulatory compliance	Monitors communications for potential insider trading language, market manipulation, or regulatory boundary violations
Conflict of interest	Detects communications between groups that should be separated (e.g. investment banking team messaging research analysts)
Custom policy	Build a policy using any combination of SITs, keyword lists, classifiers, and communication direction (inbound, outbound, internal)

ℹ️ Communication Compliance Role Requirements

Communication Compliance Admins can create and configure policies. Communication Compliance Analysts can review flagged items in their assigned policy but cannot see items from other policies. Communication Compliance Investigators have access across all policies and can escalate to eDiscovery. No role — including Global Administrator — can view Communications Compliance message content without being explicitly assigned to a policy reviewer role.

💡 Best Practices

Enable audit logging immediately in any new tenant — it is not on by default in all configurations and events are not retroactively captured
For legal holds, always use eDiscovery Standard or Premium cases rather than retention policies — eDiscovery holds are explicitly scoped to a legal matter and can be released cleanly when the case closes
Connect an HR connector in Insider Risk Management to enable the “Data theft by departing users” policy — this policy requires resignation dates from HR to set the detection window
Start Communication Compliance with a small pilot scope before rolling out tenant-wide — this validates policy accuracy and gives reviewers time to calibrate

🎓 Interview Q&A

Q: Legal counsel has asked for all emails sent by a specific employee (who is now suspended) to be preserved immediately and made available for review. The investigation is sensitive and must not be visible to other eDiscovery Managers. What do you do?

Step 1 — Create an eDiscovery case: Create a new eDiscovery Standard (or Premium) case. Give it a neutral name that doesn’t identify the employee in the case title. Add only the specific Legal team members who need access as case members — other eDiscovery Managers will not be able to see or access this case.

Step 2 — Place a legal hold: In the case, create a hold scoped to the employee’s Exchange mailbox. The hold preserves ALL content in the mailbox immediately — even items the user may delete are captured in Recoverable Items and held by the compliance engine.

Step 3 — Confirm and document: Download the hold report from the case to confirm the hold is active. Document the hold creation date and scope in your legal hold register.

Step 4 — Run a search for review: Within the case, create a content search scoped to the employee’s mailbox for the relevant time period. Export results or (with Premium) add them to a review set for attorney review.

🎯 SC-400 Mock Test — Final Module

Module 6 — eDiscovery, Audit & Insider Risk

5 questions · Scenario-based · Pass mark: 70%

Q1 of 5

A security analyst needs to investigate a BEC attack and determine which specific emails the attacker read in the victim’s mailbox over the past 30 days. Which audit feature provides this level of detail?

AAudit Standard — search for “MailboxLogin” operations in the Unified Audit Log

BContent Search — run a search for all emails in the victim’s mailbox from the past 30 days

CAudit Premium — search for the “MailItemsAccessed” event, which logs every email item a user (or attacker) accessed

DInsider Risk Management — the BEC attack alert will appear in the IRM dashboard under “Unusual email access”

✅ C. MailItemsAccessed is a critical audit event exclusive to Audit Premium (E5). It records every time a mail item is read or accessed — including by an attacker operating through OAuth tokens or delegated access. This is the definitive forensic tool for BEC investigations. Audit Standard does NOT log this event.

Q2 of 5

An eDiscovery Manager creates an eDiscovery Standard case and adds themselves and one attorney as members. A second eDiscovery Manager tries to access the case and cannot find it. What is the correct explanation?

AThis is expected — eDiscovery Managers can only see cases they created or were added to as members. The second manager needs to be added to the case or assigned the eDiscovery Administrator role to view all cases.

BThe case is in a closed state — closed cases are hidden from all members except the Global Administrator

COnly one eDiscovery case can exist at a time — the second manager must wait for the existing case to be closed

DThe eDiscovery Manager role has been removed from the second manager

✅ A. eDiscovery Managers have case-scoped visibility — they can only see and access cases they created OR cases where they were explicitly added as a case member. This is intentional for privilege and confidentiality. The eDiscovery Administrator role grants tenant-wide visibility into all cases.

Q3 of 5

An employee in the Finance team gave notice yesterday and will leave in 2 weeks. The security team wants to be automatically alerted if the employee downloads an unusual volume of files from SharePoint in their final weeks. Which IRM policy template should they use?

AGeneral data leaks — monitors all users for broad data exfiltration patterns

BSecurity policy violations — detects when users bypass security controls on their devices

CData leaks by priority users — scopes detection to high-risk user groups like Finance

DData theft by departing users — uses the HR connector resignation date to set a heightened detection window for the employee’s remaining tenure

✅ D. “Data theft by departing users” is specifically designed for this scenario. When the HR connector provides the employee’s resignation date, IRM uses it to set a detection window (typically starting 30 days before the departure date). Any data exfiltration activities during this period are scored higher and generate alerts at a lower threshold than for non-departing employees.

Q4 of 5

A financial services firm needs to retain Unified Audit Log events for 5 years to meet FINRA requirements. Which product and configuration achieves this?

AAudit Standard — extend the default 90-day retention to 5 years in the audit settings page

BAudit Premium — create an audit retention policy specifying a 5-year (1825 day) retention period for the Exchange, SharePoint, and Entra ID record types

CExport the audit log to Azure Blob Storage monthly using PowerShell and retain externally

DConfigure a retention policy in Microsoft Purview to retain audit data for 5 years

✅ B. Audit Premium (E5 or add-on) is required for extended audit retention. You create audit retention policies in the compliance portal, specifying the workloads, record types, users, and retention duration — up to 10 years. Audit Standard cannot be extended beyond 90 days. Retention policies (D) manage content retention, not audit log retention — these are separate systems.

Q5 of 5

A Communication Compliance reviewer reports they can see flagged messages from a Teams channel they are not responsible for. Another policy’s reviewer cannot see messages from that channel at all. What is the most likely cause?

AThe first reviewer has been assigned the Communication Compliance Investigator role, which provides access to all policies; the second reviewer only has Communication Compliance Analyst, which is limited to their own assigned policy

BThe Teams channel is set to Public, which means all Communication Compliance reviewers can see its messages regardless of policy scope

CCommunication Compliance policies cannot be scoped to specific Teams channels — they always cover all channels tenant-wide

DThe Global Administrator role grants access to Communication Compliance even without a specific CC role assignment

✅ A. Communication Compliance uses a tiered role model. Analysts can only see flagged items from the specific policies they’ve been assigned to as reviewers. Investigators have broader access across policies and can escalate to eDiscovery. The first reviewer’s broader access explains why they see items from an unassigned policy — they have Investigator privileges.

Module 6: eDiscovery, Audit & Insider Risk Management