Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 subscription. You have a user named User1. Several users have full access to the mailbox of User1. Some email messages sent to User1 appear to have been read and deleted before the user viewed them. When you search the audit log in the Microsoft Purview portal to identify who signed in to the mailbox of User1, the results are blank. You need to ensure that you can view future sign-ins to the mailbox of User1. Solution: You run the Set-AuditConfig -Workload Exchange command. Does that meet the goal?

Question

Accepted Answer

B. No When searches for mailbox sign-in activity return blank results, the root cause is that the MailboxLogin audit action is not enabled for the user's mailbox, as it is not audited by default even when mailbox auditing is on. A solution that does not specifically add MailboxLogin to the mailbox audit configuration for User1 will not produce sign-in records in the audit log. Without targeting the correct audit action, the search results will remain blank.

Answer

A. Yes Answering Yes would be incorrect because the proposed solution does not address enabling the specific MailboxLogin audit action required to capture mailbox sign-in events.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might…

Question

Options

How the community answered

Why each option

Topics

Community Discussion