Exam SC-200 topic 1 question 51 discussion

1. Activities: These are the actions performed in your environment that are logged for auditing purposes. They can include a variety of actions such as file sharing, downloading files, copying files, etc. 2. Record Type: This refers to the type of data source from which the activity records are retrieved. It can be Microsoft Teams, OneDrive, PowerBiAudit. 3. Workload: This refers to the specific service or application where the activity took place. It can be Microsoft Teams, OneDrive, PowerBi, SharePoint, etc. Now, tying them up: - The activity is "Share file, folder or site" because User1 shared a Power BI report file. This activity logs any instance of sharing a file, folder, or site. - The record type is "OneDrive"because the Power BI report file was stored in OneDrive, and we want to retrieve activity records from there. - The workload is "Microsoft Teams" because the sharing activity was performed through Microsoft Teams.

Oh man, this question is messed up. I think it's like this, but if anyone has actually had the opportunity to test this, please shed some light. Activities: Shared file, folder, or site <https://learn.microsoft.com/en-us/purview/audit-log-activities#sharing-and-access-request-activities> "Shared file, folder, or site: User (member or guest) shared a file, folder, or site in SharePoint or OneDrive for Business with a user in your organization's directory. The value in the Detail column for this activity identifies the name of the user the resource was shared with and whether this user is a member or a guest." Record Type: Microsoft Teams <https://learn.microsoft.com/en-us/purview/audit-log-detailed-properties> "Record Type: The type of operation indicated by the record. This property indicates the service or feature that the operation was triggered in." Workload: Microsoft Teams "Workload: The Microsoft 365 service where the activity occurred."

From Microsoft Teams (workload) a onedrive (Record Type) file is shared (Activity). I think DChilds explained it correct.

I spend more time on this question since it has been seen 27/04.2024 as DChilds said.. By performing some auditlog search in our current tenant.. Some selection in activities or record types limits the other selections. So.. My final review on this question is that Activities: Share file, folder, or site Record type: OneDrive Workload: OneDrive Why both record type and workload is OneDrive? When search audit logs, I found that some shares via Teams chat also seen OneDrive as workload. So first is share file because we want to find which file was shared with external so, to narrow search filter last 2 option OneDrive and also user can be selected in search but it is not case in question.

This question was in the exam 27/04/2024.

Activities: Share file, folder, or site Record type: PowerBIAudit ----> Recordtype for Power BI events (reference: https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#auditlogrecordtype) Workload: MicrosoftTeams

To identify which Power BI report file was shared by User1 from the Microsoft OneDrive folder via Microsoft Teams, you should configure the search as follows: Activities: Share file, folder, or site Record type: OneDrive Workload: MicrosoftTeams Explanation: Activities: Selecting "Share file, folder, or site" allows you to track activities related to sharing files, which includes sharing from OneDrive via Microsoft Teams. Record type: Since the sharing action originates from OneDrive, you should select "OneDrive" as the record type. Workload: The sharing action involves Microsoft Teams, so you should select "MicrosoftTeams" as the workload. This configuration ensures you can identify the specific Power BI report file that was shared from the OneDrive folder via Microsoft Teams.

Activities - sharing a file - very clear Record type : Power BI - not quite sure this one. Hopefully someone can confirm this one Workload: OneDrive - file was actually shared from OneDrive - Teams was just a media in this case

One drive will never be a record type as it falls under the workload category Cloud-based personal file management, in the form of OneDrive, is an important workload for many businesses. Other

When it comes into Power BI, the column is listed as a Type = Record

This seems to be some weird outdated question or whatever. I tested it and shared a file (PDF File (didn't have PowerBI File at hand)). Record Type was recorded as: SharePointSharingOperation Workload was: OneDrive Make your decision...

isn't the record type "microsoft teams" ? "https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#auditlogrecordtype"

Can anyone clarify with the correct answer ? For me it looks like Activities - Shared file, folder or site Record Type - Shared PowerBi report WorkLoad - Microsoft Teams

Option if your teams

Shared file, folder or site > This make sense since it's just another filee. OneDrive > The fact that it's a powerBI file does not mean much since it's not shared from powerBI. MicrosoftTeams > The activity is done from Teams.

Activities: Configure the search with activity C) Share file, folder or site, as this relates to the action of sharing the Power BI report. Record Type: You should select D) Shared Power BI Report as the record type as it allows you to identify the particular Power BI report sharing. Workload: The appropriate workload is C) PowerBi, as it relates directly to the Power BI product and will allow you to track specific events related to shared Power BI reports Reference: https://learn.microsoft.com/en-us/power-bi/admin/service-admin-auditing#search-the-audit-logs-by-file-folder-or-site

Activities: Share file, folder, or site Record type: OneDrive Workload: Onedrive https://learn.microsoft.com/en-us/purview/audit-log-detailed-properties