Why increasing audit-search record count does not fix missing JSON columns in Excel

Investigate Microsoft 365 activities to identify threats
Answer Correct answer: B — Increasing returned records does not help because Excel samples only the first 1,000 rows to build JSON columns.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that uses Microsoft Defender XDR. From the Microsoft Defender portal, you perform an audit search and export the results as a file named File1.csv that contains 10,000 rows. You use Microsoft Excel to perform Get & Transform Data operations to parse the AuditData column from File1.csv. The operations fail to generate columns for specific JSON properties. You need to ensure that Excel generates columns for the specific JSON properties in the audit search results. Solution: From Defender, you modify the search criteria of the audit search to increase the number of returned records, and then you export the results. From Excel, you perform the Get & Transform Data operations by using the new export. Does this meet the requirement?

  1. Yes
  2. No Correct Answer
audit log export excel columns json properties first 1000 rows purview audit csv

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Excel generates the split JSON columns based on the properties found in the first 1,000 rows of the AuditData column; adding more records just pushes the relevant properties further down and still omits their columns.

When Excel's Get & Transform fails to create columns for specific JSON properties in an audit export, increasing the number of returned records does not help, because Power Query derives columns only from the first 1,000 rows of the CSV.

Thinking more data fixes column generation — the problem is which rows are sampled (the first 1,000), so increasing volume makes it worse, not better.

Community Discussion (3 comments)

talosDevbot 👍 2
Answer: No From source: https://learn.microsoft.com/en-us/purview/audit-log-export-records "The JSON properties displayed in the previous screenshot (after you click Load more) are based on the properties found in the AuditData column from the first 1,000 rows in the CSV file. If there are different JSON properties in records after the first 1,000 rows, these properties (and a corresponding column) won't be included when the AuditData column is split into multiple columns. To help prevent this, consider re-running the audit log search and narrow the search criteria so that fewer records are returned."
90158a0 👍 1 Selected: B
From ChatGPT: No, this solution does not meet the requirement. The issue with generating columns for specific JSON properties in Excel from the audit search results typically arises from limitations in how Excel's Get & Transform Data (Power Query) interprets complex JSON structures. Increasing the number of returned records in the search criteria won't address this fundamental issue.
e072f83 👍 1
no: this is the step before the transform to json. https://learn.microsoft.com/en-us/purview/audit-log-export-records

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Microsoft Purview audit exports generate Excel columns for the JSON properties found in the first 1,000 rows of the AuditData column. If a specific JSON property appears only in records after the first 1,000 rows, its column is never created. Increasing the number of returned records does not change which rows are sampled, so the missing columns remain missing — the solution does NOT meet the requirement.

Why the Other Option Is Wrong

Answering Yes (A) misreads the mechanism; more records do not bring the missing properties into the sampled first 1,000 rows.

Community Comment Notes

The community is unanimous (B). talosDevbot and e072f83 cite the audit-log-export-records documentation, which explicitly states columns are based on the first 1,000 rows and that increasing records does not help.

Official Reference

https://learn.microsoft.com/en-us/purview/audit-log-export-records

Related Analysis

You have a Microsoft 365 subscription that uses Microsoft De

S-Grade

You have an Azure subscription that contains a Microsoft Sen

A-Grade

You have a Microsoft Sentinel workspace named SW1. You need

A-Grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide