Microsoft Purview Audit provides an integrated solution to help organizations effectively respond to security events, forensic investigations, internal investigations, and compliance obligations.
Thousands of user and admin operations performed in dozens of Microsoft 365 services and solutions are captured, recorded, and retained in your organization's unified audit log. Audit records for these events are searchable by security ops, IT admins, insider risk teams, and compliance and legal investigators. This capability provides visibility into the vast array of activities performed in Microsoft 365 by your users in your organization.
Today we are excited to announce new capabilities for Microsoft Purview Audit that provide a major update to the search experience and new security controls to restrict access to sensitive Audit log data.
New search experience
Audit log data is foundational to gain insight and investigate user activities. The new search experience for Microsoft Purview Audit is now generally available and provides the following key improvements:
- Search jobs continue to run, even if you close the browser. Active jobs and detailed results will be available to view and access when you return to the Audit Search home page.
- Completed search jobs are now stored for 30 days, giving your organization the ability to reference and re-use historical audit searches. These search jobs are presented in the Audit Search UI in the Purview management console, where you can find the search name, search job status, percent complete, number of results, creation time, and who created the search.
- Each Audit user can perform up to 10 concurrent search jobs.
- Audit Premium users can save even larger exports and reduce the need to batch large result sets.
Additional security controls with encryption for Audit data
Given the sensitivity of Audit log data, many organizations want to add additional layers of protection to their data. Customer Key allows organizations to use their own data encryption keys, giving them complete control over access to their data.
Get started
Try the new search experience.
We are happy to share that there is now an easier way for eligible customers to try Microsoft Purview solutions directly in the Microsoft Purview compliance portal with a free trial. By enabling the trial in the compliance portal, you can quickly start using all capabilities of Microsoft Purview, including Insider Risk Management, Records Management, Audit, eDiscovery, Communication Compliance, Information Protection, Data Lifecycle Management, Data Loss Prevention, and Compliance Manager.
Visit your Microsoft Purview compliance portal for more details or check out the Microsoft Purview solutions trial (an active Microsoft 365 E3 subscription is required as a prerequisite).
To learn more about Audit, visit our Microsoft documentation.
