Planning and zoning staff need to review who changed permissions on a courts SharePoint site after a suspicious update. Which tool concept fits?

Planning and zoning staff who need to know who changed permissions on a courts SharePoint site after a suspicious update should use audit logs that record user and admin activity related to the permission change. Microsoft 365 audit logging captures sharing, group membership, and site permission events that support investigation without destroying evidence. That trail is essential when courts-related content permissions may have been altered improperly, providing a reliable record for planning and zoning staff.

Document version history that tracks content edits across library files shows changes to document content over time, not who altered site or library permissions, so it would not reveal the suspicious permission change. The site sharing report that lists current guest links and member access levels shows who currently has access, not the specific event and actor behind the recent change, so it cannot reconstruct the history planning and zoning staff need. Recurring access review that validates continued need for site membership assignments focuses on validating access, not on reconstructing who changed permissions, so it cannot reveal the actor behind the recent suspicious update.

Exam caveat: Permission-change investigations map to audit logs (and related activity reports), not to deleting sites or toggling MFA. AB-900 distractors often propose recurring access reviews that remove site membership assignments, which can erase the very history investigators need.

Operational check: In Microsoft Purview audit (or unified audit log), search for SharePoint permission and sharing events on the courts site around the suspicious timestamp, identify the actor and target principals, validate whether the change was authorized, reverse unauthorized grants, and confirm audit retention settings remain adequate for future zoning/courts reviews.