Exam MS-100 topic 3 question 2 discussion

D is the correct answer. "Because you can search for the following types of user and admin activity in Microsoft 365: User activity in SharePoint Online and OneDrive for Business Admin activity in Exchange Online (Exchange admin audit logging)" https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide

Definitely D, Audit log search from the SCC (now compliance.microsoft.com)

D 4 sure. Azure AD audit logs do not let you search SP online activities

Audit logs in Azure display device and user athentication data. Not Activity logs.

Answer is D.

No brainer

Absolute Joke. D is the correct answer

A, are you joking? Deletion of files isn't privileged that way

Been doing since a while

1000% answer is D. Just ran exact audit on my tenant and all choices are there 😉

yes, I tested it. D is correct

just test it and its D

also D

D for me.

Should be letter D. I made some test in my LAB and compare the two. Azure Audit logs only see who reset the password. Audits Logs > Filter the activity Security & Compliance > Audit has all the necessary options that mentioned on this questions (Passwords, Deleted Folder, Opened a mailbox)

I also vote D.

So why don't they update this answer to be D?