Granting Least Privilege Audit Log Search Access
Short answer
B Assign the View-Only Audit Logs role in the Exchange admin center to User1.
Question
Key Takeaways
The exam tests the knowledge that despite the existence of Purview roles, the View-Only Audit Logs role in Exchange Online is still a valid and often cited method for granting audit search permissions with minimal impact.
This question addresses the specific role assignment required to search Microsoft 365 audit logs while adhering to the principle of least privilege. The correct answer identifies the Exchange admin center role that provides necessary permissions without granting broader administrative access.
Common mistake: Many learners select the Security Reader role (D) because it sounds appropriate for security tasks, or they choose Reviewer (A), not realizing that Security Reader does not grant audit log search permissions by default.
Expert Analysis
Why the Answer Is Correct
The View-Only Audit Logs role in the Exchange admin center allows users to view and search audit logs without granting them the ability to enable/disable auditing or perform other administrative tasks. This aligns perfectly with the principle of least privilege for the specific task of searching logs.
Why the Other Options Are Wrong
The Security Reader role (D) allows viewing security alerts but does not inherently include permission to search audit logs. The Compliance Management role (C) grants broader permissions related to compliance management, which exceeds the scope of just searching logs. The Reviewer role (A) in Purview is typically associated with content review workflows rather than audit log investigation.
Community Comment Notes
Community members frequently reference official Microsoft documentation which confirms that the View-Only Audit Logs role in Exchange Online is a supported method for this task. Some comments note that while Purview has its own roles, the Exchange-based roles remain relevant for this specific capability in many configurations.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
Always look for the most granular role that satisfies the requirement. When asked for 'least privilege' regarding audit logs, remember that specific audit roles exist separate from general security or compliance reader roles.
Frequently Asked Questions
Does the Security Reader role allow searching audit logs?
Why is the Exchange admin center used for audit roles?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
Domza 👍 4 Answered BCorrect~ Note: To search the audit log, administrators and members of investigation teams must be assigned the View-Only Audit Logs or Audit Logs role in Exchange Online with love~
-
Boeroe 👍 3None of the answers are correct, this is possible by enabling the audit reader or manager role within Purview: https://learn.microsoft.com/en-us/purview/audit-get-started#step-2-assign-permissions-to-search-the-audit-log
-
thetootall 👍 2 Answered BAccess to enable or disable auditing and access to audit cmdlets currently requires permissions from the Exchange admin center. Use the existing Audit Logs and View-Only Audit Logs roles in the Exchange admin center to grant access to audit cmdlets. Use the existing Audit Logs role in the Exchange admin center to grant access to enable or disable auditing. https://learn.microsoft.com/en-us/purview/audit-get-started#step-2-assign-permissions-to-search-the-audit-log
-
JimboJones99 👍 1 Answered Bhttps://learn.microsoft.com/en-us/purview/audit-get-started#step-2-assign-permissions-to-search-the-audit-log
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.