Microsoft 365 Security | Microsoft Purview | Microsoft Defender XDR | Unified Audit Log
If you’ve worked with both Microsoft Purview and Microsoft Defender, you may have noticed something interesting: both portals provide an Audit search experience.
In Microsoft Purview, you can access auditing through the Audit solution. In Microsoft Defender, you can access auditing directly from the security portal.
The interfaces look almost identical. They offer similar search filters, audit activities, search jobs, and export capabilities.
This raises an important question:
Are Microsoft Purview Audit and Microsoft Defender Audit two separate auditing solutions, or are they simply different ways of accessing the same data?
In this article, we’ll explore the underlying architecture, explain the differences, clarify licensing and retention, and demonstrate how security teams can use auditing during Microsoft 365 investigations.
1. Understanding the Microsoft 365 Unified Audit Log
Microsoft 365 provides a centralized auditing capability called the Unified Audit Log (UAL).
The unified audit log records supported activities performed by users, administrators, applications, and services across Microsoft 365.
Depending on the workload and licensing, recorded activities can include:
- Exchange Online mailbox operations
- SharePoint Online file access and sharing
- OneDrive file activities
- Microsoft Teams activities
- Microsoft Entra ID administrative operations
- Microsoft Purview compliance activities
- Data Loss Prevention events
- Supported Microsoft Defender administrative and security operations
These records help organizations investigate suspicious behavior, review administrative changes, support compliance requirements, and understand how information is accessed or shared.
The unified audit log is not a complete record of every action in Microsoft 365. Event coverage depends on the workload, supported operations, auditing configuration, and applicable licensing.
2. Microsoft Purview Audit vs. Microsoft Defender Audit
Here’s the most important fact:
Microsoft Purview Audit and the Audit search experience in Microsoft Defender access the same Microsoft 365 unified audit log.
Microsoft’s official documentation confirms that the audit search experience in Microsoft Defender is identical to the audit search experience in Microsoft Purview.
Side-by-side comparison
| Capability | Microsoft Purview Audit | Microsoft Defender Audit |
|---|---|---|
| Portal | purview.microsoft.com | security.microsoft.com |
| Underlying audit data | Microsoft 365 Unified Audit Log | Same Unified Audit Log |
| Audit search | Supported | Supported |
| Exchange Online audit records | Supported | Supported |
| SharePoint and OneDrive audit records | Supported | Supported |
| Supported DLP audit records | Supported | Supported |
| Audit retention | Based on Microsoft Purview audit retention | Same retention configuration |
| Separate audit database | No | No |
| Surrounding workflows | Compliance and data security | Security operations and threat investigation |
The difference is therefore primarily the portal experience and the workflows surrounding the audit search, rather than the audit data itself.
Microsoft Purview Audit
Microsoft Purview is designed around data security, governance, compliance, and risk management.
Audit integrates naturally with capabilities such as:
- Data Loss Prevention
- Information Protection
- Insider Risk Management
- eDiscovery
- Compliance investigations
For example, a data security analyst investigating the external sharing of confidential documents may use audit records to establish who accessed the files, when they were shared, and which operations occurred.
Microsoft Defender Audit
Microsoft Defender focuses on threat detection, investigation, and response.
Providing access to unified audit search allows SOC analysts to retrieve Microsoft 365 activity records from their security operations environment.
For example, during a compromised-account investigation, an analyst may examine mailbox operations, administrative changes, and file access events alongside Microsoft Defender security alerts.
Key takeaway: Both teams can search the same underlying audit records, but their investigation objectives may differ.
3. Understanding the Architecture
The architecture is easier to understand when we separate the data source from the tools used to investigate it.
Layer 1: Microsoft 365 workloads
Supported activities originate from services such as:
- Exchange Online
- SharePoint Online
- OneDrive
- Microsoft Teams
- Microsoft Entra ID
- Microsoft Purview
- Supported Microsoft Defender services
Layer 2: Microsoft 365 Unified Audit Log
Supported audit events are collected and made searchable through the Microsoft 365 auditing service.
The available records depend on the applicable retention periods, licensing, and permissions.
Layer 3: Audit search interfaces
Authorized users can access the audit data through:
Microsoft Purview Audit
Microsoft Defender Audit
https://security.microsoft.com/auditlogsearch
Both interfaces access the unified auditing capability.
What about Microsoft Defender XDR?
This is where an important architectural distinction exists.
Microsoft Defender XDR provides additional security investigation capabilities, including:
- Security alerts
- Correlated incidents
- Advanced hunting
- Endpoint security telemetry
- Identity-related security signals
- Email and collaboration threat detections
These capabilities are not simply another copy of the unified audit log.
Defender XDR security telemetry and Microsoft 365 audit records are complementary data sources.
Some supported Defender administrative and security operations are recorded in the unified audit log, but that does not mean every Defender detection, endpoint event, or hunting record is stored there.
For security architects, understanding this distinction is essential when designing investigation and monitoring workflows.
4. Practical Example: Investigating a DLP Event
Consider an organization using Microsoft Purview Data Loss Prevention to monitor sensitive information shared through Exchange Online.
A DLP policy identifies an email that matches a configured rule.
The investigation can involve three different capabilities.
Step 1: Investigate the DLP alert
Navigate to:
Microsoft Purview → Data Loss Prevention → Alerts
Review the available information:
- DLP policy name
- Matched rule
- Affected user
- Activity and destination
- Alert severity
- Detected sensitive information, when applicable
The DLP alert provides a policy-focused view of the potential data security risk.
Step 2: Search the unified audit log
Navigate to:
Microsoft Purview → Audit → Search
Configure a search using the relevant:
- Date and time range
- User account
- Activities
- Record types
- Workloads
For Exchange DLP investigations, one relevant audit record type is ComplianceDLPExchange.
However, record availability and operation names depend on the event and workload.
Start with a broad search if you do not know the exact operation, then narrow the results based on the evidence returned.
Audit records can provide additional context, but not every DLP alert necessarily produces an identically named or independently searchable audit event.
Step 3: Correlate with Microsoft Defender
If the activity suggests a potential security incident, review Microsoft Defender for related alerts and incidents.
For example, determine whether the same account has also exhibited suspicious authentication activity or other security signals.
This approach combines three complementary investigation perspectives:
| Capability | Primary purpose |
|---|---|
| Microsoft Purview DLP | Detect policy matches and potential data loss |
| Microsoft Purview Audit | Investigate supported recorded activities |
| Microsoft Defender XDR | Investigate threats, alerts, and incidents |
Special consideration: DLP simulation mode
When testing DLP policies in simulation mode, simulated alerts are available through the policy’s simulation experience.
These should not be confused with alerts displayed in the main DLP Alerts dashboard.
If a DLP policy appears to generate no alerts, first verify the policy’s simulation results and status before concluding that detection has failed.
5. Microsoft Purview Audit Standard vs. Audit Premium
Although Purview and Defender provide the same unified audit-search capability, Audit Standard and Audit Premium offer different licensing-dependent features.
This is a much more meaningful technical distinction.
| Capability | Audit Standard | Audit Premium |
|---|---|---|
| Unified audit search | Yes | Yes |
| Search and export supported records | Yes | Yes |
| Default standard retention | 180 days | 180 days for records not covered by longer retention |
| One-year default retention for eligible records | No | Yes |
| Custom audit retention policies | No | Yes |
| Additional intelligent audit insights | No | Yes |
| Higher-bandwidth Management Activity API access | No | Yes |
| Ten-year retention | No | With additional licensing |
Audit Standard
Microsoft Purview Audit Standard provides core audit-search capabilities and a default retention period of 180 days for applicable audit records.
It supports investigations involving activities recorded within that retention window.
Audit Premium
Microsoft Purview Audit Premium extends auditing with capabilities such as longer retention, custom retention policies, and additional investigation insights.
A key benefit is one-year default retention for eligible Exchange Online, SharePoint, OneDrive, and Microsoft Entra ID audit records.
However, this one-year retention does not automatically apply to every audit event or every user.
Licensing matters
The one-year default retention policy applies to qualifying records generated by users with eligible licenses, such as Microsoft 365 E5 or qualifying Microsoft Purview auditing add-ons.
Records generated by users without the required licenses, including guest users in applicable scenarios, generally remain subject to the standard 180-day retention.
Other audit workloads also generally have a 180-day default unless a qualifying retention policy or specific exception applies.
What about ten-year retention?
Microsoft offers optional ten-year audit log retention through additional licensing.
This requires the appropriate add-on license and retention policy configuration.
The policy is not retroactive: configuring ten-year retention does not restore audit records that have already expired.
Architecture recommendation: Before designing an audit retention strategy, verify the organization’s license assignments, required investigation window, supported record types, and retention policies.
6. Permissions and Access Control
Access to audit records is controlled through Microsoft 365 permissions and role-based access control.
Relevant permissions include:
- View-Only Audit Logs
- Audit Logs
These permissions can be provided through appropriate role groups, including:
- Audit Reader
- Audit Manager
- Other authorized compliance or administrative role groups
Microsoft also documents relevant Exchange Online and Microsoft Entra administrative roles that can grant audit-search access.
Role versus role group
It is important to distinguish between the two:
Role: Defines a particular permission or set of capabilities.
Role group: Groups roles together and assigns them to authorized users.
For example, the Audit Reader role group can provide audit-reading permissions without requiring the user to become a Global Administrator.
Administrative unit scoping
Organizations using Microsoft Purview administrative units should also consider scoped audit access.
A restricted administrator may only be able to search user-generated audit records within their assigned administrative units.
This means two authorized analysts can potentially see different results depending on their assigned scopes.
Security recommendation: Use least-privilege role assignments and review administrative unit restrictions before investigating missing audit records.
7. Common Misconceptions
Misconception 1: Microsoft Purview Audit and Microsoft Defender Audit use separate databases
Incorrect.
Both portal experiences access the Microsoft 365 unified audit log.
Misconception 2: Defender XDR advanced hunting and unified audit search are the same
Incorrect.
They serve different purposes and expose different datasets, although some activities and investigations may overlap.
Misconception 3: Microsoft 365 E5 guarantees one-year retention for every audit event
Incorrect.
One-year default retention applies to qualifying workloads and records generated by appropriately licensed users. Other retention rules and exceptions must be considered.
Misconception 4: Every DLP alert becomes a Microsoft Defender incident
Incorrect.
DLP alerts and Defender incidents are distinct investigation objects. Correlation depends on supported integrations and detection workflows.
Misconception 5: Global Administrator is required to search audit logs
Incorrect.
Appropriate audit permissions and role groups can provide access without assigning Global Administrator.
8. Which Portal Should Security Professionals Use?
The choice depends on the investigation workflow.
| Investigation scenario | Recommended starting point |
|---|---|
| DLP policy violations | Microsoft Purview |
| Sensitive document sharing | Microsoft Purview |
| Compliance investigation | Microsoft Purview |
| Insider risk investigation | Microsoft Purview |
| Compromised user account | Microsoft Defender |
| Threat detection and response | Microsoft Defender |
| Security incident correlation | Microsoft Defender |
| Unified audit log search | Either portal |
These are practical recommendations rather than technical restrictions.
An authorized analyst can use either portal to search the same underlying unified audit data.
9. Recommendations for Microsoft 365 Security Architects
When designing auditing and investigation capabilities for an organization, I recommend focusing on five areas.
1. Validate audit coverage
Identify the Microsoft 365 workloads and activities that must be monitored.
2. Review licensing
Determine which users are licensed for Audit Standard and Audit Premium capabilities.
3. Define retention requirements
Align audit retention with incident response, regulatory obligations, and forensic investigation needs.
4. Implement least-privilege access
Assign dedicated audit roles and validate administrative unit scoping.
5. Establish investigation workflows
Document when analysts should use Purview DLP, unified audit search, Defender XDR, and other security data sources.
These decisions are more important than choosing which portal displays the audit-search interface.
Conclusion
Microsoft Purview Audit and Microsoft Defender Audit are not two competing auditing solutions.
They provide access to the same Microsoft 365 unified audit log through different portal experiences.
The real technical considerations are:
- Which activities are audited
- Which records are available
- How long those records are retained
- Which users have permission to search them
- How audit evidence is correlated with DLP alerts and Defender XDR security telemetry
For Microsoft 365 security architects, understanding these distinctions is essential for designing effective auditing, data protection, and incident investigation capabilities.
One unified audit log. Two portal experiences. Complementary security and compliance workflows.
Official Microsoft Learn References
- Audit log search in the Microsoft Defender portal
- Search the audit log in Microsoft Purview
- Learn about auditing solutions in Microsoft Purview
- Manage audit log retention policies
- Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview
- Search the audit log for events in Microsoft Defender XDR
