You create a new Microsoft 365 subscription and assign Microsoft 365 E3 licenses to 100 users. From the Security & Compliance admin center, you enable auditing. You are planning the auditing…

The correct answer is A. An administrator creates a new Microsoft SharePoint site collection. B. An administrator creates a new mail flow rule. C. A user shares a Microsoft SharePoint folder with an external user. When auditing is enabled in the Microsoft 365 Security & Compliance center with E3 licenses, the unified audit log captures a broad range of activities by default. (A) Creating a SharePoint site collection is a standard SharePoint admin activity that is captured. (B) Creating a…

Submitted by salim_om· Apr 18, 2026Manage compliance by using Microsoft Purview

Question

You create a new Microsoft 365 subscription and assign Microsoft 365 E3 licenses to 100 users. From the Security & Compliance admin center, you enable auditing. You are planning the auditing strategy. Which three activities will be audited by default? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

Options

AAn administrator creates a new Microsoft SharePoint site collection.
BAn administrator creates a new mail flow rule.
CA user shares a Microsoft SharePoint folder with an external user.
DA user delegates permissions to their mailbox.
EA user purges messages from their mailbox.

How the community answered

(36 responses)

A
78% (28)
D
6% (2)
E
17% (6)

Explanation

When auditing is enabled in the Microsoft 365 Security & Compliance center with E3 licenses, the unified audit log captures a broad range of activities by default. (A) Creating a SharePoint site collection is a standard SharePoint admin activity that is captured. (B) Creating a mail flow rule is a standard Exchange admin activity that is audited. (C) Sharing a SharePoint folder with an external user is a standard SharePoint user activity that is audited. (D) Mailbox permission delegation is NOT audited by default in E3 - it requires enabling mailbox audit logging with specific actions enabled. (E) Purging messages from a mailbox (hard deletes) requires Microsoft 365 Advanced Audit (E5 or add-on) to capture by default. Therefore A, B, and C are the three activities audited by default.

Topics

#Unified Audit Log#Default audit activities#M365 auditing#Exchange/SharePoint auditing

Community Discussion

No community discussion yet for this question.

Full MS-102 Practice