After a suspicious admin role change, auditors ask whether Microsoft 365 retained an activity history they can investigate. Which Purview benefit answers that need?

After a suspicious admin role change, auditors asking whether Microsoft 365 retained activity history are asking about Purview auditing: audit history enables forensic and compliance investigations of user and admin activities. That benefit is why municipalities keep auditing enabled and searchable for privilege and configuration changes.

Auditing is not unnecessary because Teams always posts role changes to public channels—role changes are not reliably a public channel feed. Auditing does not only store cafeteria menu edits for Facilities. Auditing does not permanently delete all logs every midnight by default for every tenant as a normal design.

Exam caveat: retention duration and advanced audit features can vary by license; fundamentals stress the investigative value of the audit trail. Operational check: search for the admin role change in the audit log, export the record for auditors, and confirm privileged role groups who can purge logs are tightly controlled. In municipal Microsoft 365 fundamentals scenarios, always map the business need to the named capability, reject distractors that describe a different pillar, and verify the control in the admin portal before telling leadership the risk is closed.