Microsoft
MS-900 · Question #168
Your company has a Microsoft 365 subscription. You need to identify which users performed the following privileged administration tasks: - Deleted a folder from the second-stage Recycle Bin of…
The correct answer is D. Security & Compliance audit log search. These activities are listed in the S&C audit log search but not in the Azure audit logs.
Submitted by ricky.ec· Mar 5, 2026Describe security, compliance, privacy, and trust in Microsoft 365
Question
Your company has a Microsoft 365 subscription. You need to identify which users performed the following privileged administration tasks: - Deleted a folder from the second-stage Recycle Bin of Microsoft SharePoint - Opened a mailbox of which the user was not the owner - Reset a user password What should you use?
Options
- AMicrosoft Azure Active Directory (Azure AD) audit logs
- BSecurity & Compliance content search
- CMicrosoft Azure Active Directory (Azure AD) sign-ins
- DSecurity & Compliance audit log search
How the community answered
(21 responses)- A5% (1)
- B5% (1)
- C14% (3)
- D76% (16)
Explanation
These activities are listed in the S&C audit log search but not in the Azure audit logs.
Topics
#Audit logging#Security & Compliance Center#SharePoint Online#Exchange Online#User activity monitoring
Community Discussion
No community discussion yet for this question.