You have a Microsoft 365 subscription linked to a Microsoft Entra tenant that contains a user named User1. You need to grant User1 permission to search Microsoft 365 audit logs. The solution must…

The Compliance Management role grants extensive administrative control over compliance features across Microsoft Purview and far exceeds the least-privilege requirement for simply searching audit logs.

The Security Reader role in Microsoft Entra provides read access to Entra security information but does not grant permission to search the Microsoft 365 unified audit log in the Purview portal.

The View-Only Audit Logs role, assigned through the Exchange admin center compliance role groups, grants read-only access to search and review Microsoft 365 unified audit logs in the Microsoft Purview portal. It satisfies least privilege because it provides only audit log visibility without granting any broader compliance, security, or administrative permissions. No other role with narrower scope accomplishes this task.

The Reviewer role in Microsoft Purview is scoped to reviewing content within eDiscovery cases and does not provide general access to search the unified audit log.