Reducing rows before the JSON transform so Excel generates the needed audit columns

SC-200 By islever Editorial Last updated

Investigate Microsoft 365 activities to identify threats

Short answer

A Filtering to reduce rows can move the records with the missing properties into the first 1,000 sampled rows, so their columns are generated.

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that uses Microsoft Defender XDR. From the Microsoft Defender portal, you perform an audit search and export the results as a file named File1.csv that contains 10,000 rows. You use Microsoft Excel to perform Get & Transform Data operations to parse the AuditData column from File1.csv. The operations fail to generate columns for specific JSON properties. You need to ensure that Excel generates columns for the specific JSON properties in the audit search results. Solution: From Excel, you apply filters to the existing columns in File1.csv to reduce the number of rows, and then you perform the Get & Transform Data operations to parse the AuditData column. Does this meet the requirement?
  1. Yes Correct Answer
  2. No

Key Takeaways

Because Excel builds JSON columns from the first 1,000 rows, filtering to reduce the total rows can bring the records with the missing properties into that sampled window, allowing their columns to be generated — so the solution meets the requirement.

To make Excel create columns for specific JSON properties in an audit export, you reduce the number of rows (for example by filtering) so that records containing those properties fall within the first 1,000 rows Power Query samples, then run Get & Transform.

Common mistake: Thinking row count is irrelevant — while the root issue is which rows are sampled, reducing rows so the relevant records land in the first 1,000 is the documented workaround that makes the columns appear.

Expert Analysis

Why the Answer Is Correct

Excel's Get & Transform generates split JSON columns from the properties in the first 1,000 rows of the AuditData column. By filtering the existing columns to reduce the number of rows before performing the transform, you can move records that contain the specific JSON properties into that first 1,000-row sampled window, causing their columns to be created. This matches the documented workaround, so the solution meets the requirement.

Why the Other Option Is Wrong

Answering No (B) ignores the documented workaround of reducing rows so the relevant properties are sampled.

Community Comment Notes

talosDevbot and laddu001 confirm Yes, citing the audit-log-export-records documentation, which lists filtering to reduce rows as a workaround before transforming the JSON. liveup2it argues No, but the documented guidance supports Yes.

Official Reference

https://learn.microsoft.com/en-us/purview/audit-log-export-records

This link opens the official vendor documentation in a new tab.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. talosDevbot 👍 6
    Answer: Yes From source: https://learn.microsoft.com/en-us/purview/audit-log-export-records "The JSON properties displayed in the previous screenshot (after you click Load more) are based on the properties found in the AuditData column from the first 1,000 rows in the CSV file. If there are different JSON properties in records after the first 1,000 rows, these properties (and a corresponding column) won't be included when the AuditData column is split into multiple columns. To help prevent this, consider re-running the audit log search and narrow the search criteria so that fewer records are returned. Another workaround is to filter items in the Operations column to reduce the number of rows (before you perform step 5 above) before transforming the JSON object in the AuditData column."
  2. laddu001 👍 3
    Yes..Another workaround is to filter items in the Operations column to reduce the number of rows (before you perform step 5 above) before transforming the JSON object in the AuditData column.
  3. liveup2it 👍 3
    No, Excel fails to create columns, not rows...

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide