Reducing returned records from Defender before export so Excel builds the audit JSON columns

Investigate Microsoft 365 activities to identify threats
Answer Correct answer: A — Reducing returned records before export keeps the relevant JSON properties within the first 1,000 rows Excel samples, so their columns are created.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that uses Microsoft Defender XDR. From the Microsoft Defender portal, you perform an audit search and export the results as a file named File1.csv that contains 10,000 rows. You use Microsoft Excel to perform Get & Transform Data operations to parse the AuditData column from File1.csv. The operations fail to generate columns for specific JSON properties. You need to ensure that Excel generates columns for the specific JSON properties in the audit search results. Solution: From Defender, you modify the search criteria of the audit search to reduce the number of returned records, and then you export the results. From Excel, you perform the Get & Transform Data operations by using the new export. Does this meet the requirement?

  1. Yes Correct Answer
  2. No
audit search reduce records excel json columns purview audit export

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Reducing the exported record count from the source (Defender) so the relevant properties appear in the first 1,000 rows is the documented way to make Excel generate their columns during the JSON transform.

To ensure Excel generates columns for specific JSON properties, you modify the Defender audit-search criteria to return fewer records before exporting, so the records with those properties are within the first 1,000 rows Power Query samples.

Exporting the full 10,000 rows — the records with the missing properties may sit beyond the first 1,000 rows and never get columns, so reducing the export scope is the fix.

Community Discussion (3 comments)

e072f83 👍 4 Selected: A
The JSON properties displayed in the previous screenshot (after you click Load more) are based on the properties found in the AuditData column from the first 1,000 rows in the CSV file. If there are different JSON properties in records after the first 1,000 rows, these properties (and a corresponding column) won't be included when the AuditData column is split into multiple columns. To help prevent this, consider re-running the audit log search and narrow the search criteria so that fewer records are returned. Another workaround is to filter items in the Operations column to reduce the number of rows (before you perform step 5 above) before transforming the JSON object in the AuditData column. https://learn.microsoft.com/en-us/purview/audit-log-export-records
smosmo 👍 1 Selected: A
The JSON properties displayed in the previous screenshot (after you click Load more) are based on the properties found in the AuditData column from the first 1,000 rows in the CSV file. If there are different JSON properties in records after the first 1,000 rows, these properties (and a corresponding column) won't be included when the AuditData column is split into multiple columns. To help prevent this, consider re-running the audit log search and narrow the search criteria so that fewer records are returned. Another workaround is to filter items in the Operations column to reduce the number of rows (before you perform step 5 above) before transforming the JSON object in the AuditData column.
smosmo 👍 2
Correct, you have to reduce the records:https://learn.microsoft.com/en-us/purview/audit-log-export-records

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Excel derives the split JSON columns from the first 1,000 rows of the AuditData column. By tightening the Defender audit-search criteria to return fewer records, the export's first 1,000 rows are more likely to contain the specific JSON properties, and their columns are generated during Get & Transform. This is the documented approach, so the solution meets the requirement.

Why the Other Option Is Wrong

Answering No (B) would ignore the documented guidance that reducing the number of records before export helps surface the missing properties.

Community Comment Notes

The community is unanimous (A 100). e072f83 and smosmo cite the audit-log-export-records documentation, noting you must reduce the records so the relevant JSON properties fall within the first 1,000 sampled rows.

Official Reference

https://learn.microsoft.com/en-us/purview/audit-log-export-records

Related Analysis

You have a Microsoft 365 subscription that uses Microsoft De

A-Grade

You have a Microsoft 365 subscription that uses Microsoft De

S-Grade

You have a Microsoft 365 subscription that uses Microsoft De

A-Grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide