20.1 Assign Microsoft Purview Audit (Premium) User Licenses

Assign Microsoft Purview Audit (Premium) User Licenses

Quick Answer: Audit (Premium) is a per-user benefit. Assign an eligible E5, A5, G5, Purview Suite, or eDiscovery and Audit add-on license, then enable the Microsoft 365 Advanced Auditing app on each user. Premium adds one-year default retention for Microsoft Entra ID, Exchange, OneDrive, and SharePoint records, custom audit log retention policies, intelligent insights, and higher Office 365 Management Activity API bandwidth. Ten-year retention requires a separate per-user add-on.

Microsoft Purview Audit is the unified audit log for Microsoft 365. When a user or admin performs an audited activity, the service writes a record you can search from the Microsoft Purview portal, Exchange Online PowerShell (Search-UnifiedAuditLog), Microsoft Graph, or the Office 365 Management Activity API. Audit (Standard) is that search surface plus 180-day retention. Audit (Premium) — formerly Microsoft 365 Advanced Audit — is not a different portal. It is extra retention, extra forensic properties, and extra API bandwidth that apply only to users who hold an eligible license.

SC-401 tests whether you treat Premium as a user license assignment problem, not a tenant-wide toggle. One E5 license on an admin account does not give every mailbox one-year retention or intelligent insights.

Standard versus Premium capabilities

Audit (Premium) includes every Audit (Standard) capability. Microsoft's auditing solutions overview (updated 2026-05-18) compares them as follows.

Microsoft changed the Standard default from 90 days to 180 days. Records generated before 17 October 2023 keep a 90-day lifetime. Records generated on or after that date follow 180 days. Do not teach 90 days as the current Standard default.

Classic Search retired on 30 November 2023. New Search is the current portal experience for both Standard and Premium.

Which licenses grant Audit (Premium)

The Microsoft Purview service description (updated 2026-08-03) lists Audit (Premium) for:

• Microsoft 365 E5 / A5 / G5
• Office 365 E5 / A5 / G5
• Microsoft Purview Suite (including EDU, GOV, and frontline variants) and Microsoft Defender + Purview Suite for frontline workers
• Microsoft 365 E5 / G5 / F5 eDiscovery and Audit add-ons
• Microsoft Purview Suite for Business Premium (requires a Microsoft 365 Business Premium base license and is capped at 300 seats)

Microsoft 365 E3, Office 365 E3, and Microsoft 365 Business Basic / Standard / Premium include Audit (Standard) only. E3 users can receive Premium through an eligible add-on. Microsoft does not publish a path that turns an E1-only user into an Audit (Premium) user without moving that user onto an eligible SKU or add-on.

One-year retention and crucial-event logging apply only to users who hold the license. Guest users and unlicensed accounts fall back to 180-day Standard retention even inside an E5 tenant. The Purview service description's licensing rule is that users who benefit must be licensed: mailbox, OneDrive, Teams chat, and device locations are tied to a user account; for shared SharePoint sites, Microsoft 365 Groups, and Teams channels, owners and members need the license when the feature is used there.

Assign the license and the Advanced Auditing app

Premium features such as intelligent insights require both the SKU and the service plan. Microsoft's get-started article (updated 2026-02-18) documents this sequence for each user:

1. In the Microsoft 365 admin center, open Users > Active users and select the user.
2. Open Licenses and apps.
3. Confirm an eligible E5 or add-on license is assigned.
4. Expand Apps and select Microsoft 365 Advanced Auditing.
5. Save. Logging of Audit (Premium) insights begins within 24 hours.

Skipping the Advanced Auditing checkbox is a common lab and exam trap: the user shows an E5 license, but Premium insights never appear.

If someone previously customized the mailbox actions that are logged on user or shared mailboxes, newly released Audit (Premium) mailbox events are not automatically added. Restore or update mailbox auditing so those actions are logged. Microsoft documents this under mailbox auditing: change or restore mailbox actions logged by default.

Intelligent insights and forensic properties

Premium intelligent insights add forensic properties that Standard search does not surface. They help you scope a breach: which labeled messages were accessed, and what a user searched for in Exchange Online or SharePoint Online.

Microsoft currently publishes these Premium activity properties:

• Exchange Online: MailItemsAccessed includes a SensitivityLabel property so investigators can see the sensitivity label on accessed mail items.
• Microsoft Teams: activities such as MessageSent, MessageRead, ChatCreated, ChatRetrieved, and related chat operations include properties such as AppAccessContext, ParticipantInfo, ParticipatingDomainInformation, and meeting fields like IsJoinedFromLobby / ArtifactShared.

Do not confuse the Premium property with the MailItemsAccessed action. Microsoft's compromised-account article (updated 2026-06-24) states that the MailItemsAccessed action is Audit (Standard) mailbox auditing, enabled by default for users assigned Office 365 E3/E5 or Microsoft 365 E3/E5. The Premium value is the extra forensic property (sensitivity label on accessed items) plus related search-query insights — not the existence of the action itself.

Two search-query events are not on by default even for Premium users. You must enable them per mailbox in Exchange Online PowerShell:

Set-Mailbox user@contoso.com -AuditOwner @{Add="SearchQueryInitiated"}

That setting logs SearchQueryInitiatedExchange and SearchQueryInitiatedSharePoint. In a multi-geo tenant, run the cmdlet in the forest that hosts the mailbox. If you previously enabled it in the wrong forest, remove SearchQueryInitiated there and add it in the mailbox's forest. These cmdlets apply only to SearchQueryInitiated events, not to the rest of the audit log.

Ten-year retention is a separate add-on

The 10-Year Audit Log Retention add-on is per user and is not included in E5. After you assign it, you still must create a 10-year audit log retention policy that targets that user. The policy is not retroactive: records created before the policy existed keep their original lifetime.

Audit records generated by non-user entities (service principal actions, system events, and application activities) are retained for a fixed one year. Microsoft states that this period is not configurable and that custom audit log retention policies do not apply to those records.

API bandwidth and when Standard is not on by default

All organizations start at a baseline of 2,000 Office 365 Management Activity API requests per minute. The cap then scales with seat count and SKU. E5 / A5 / G5 organizations receive about twice the bandwidth of non-E5 organizations. Microsoft publishes that ratio and a service-health cap; it does not publish an exact per-tenant maximum you should memorize as a hard number.

Audit (Standard) is enabled by default for most enterprise subscriptions. It is not enabled by default for Microsoft 365 Business Basic, Business Standard, Business Premium, or unmanaged tenants using free trials of enterprise licenses. Those organizations must turn auditing on in the Purview portal. Turning auditing on starts the 180-day Standard clock; it does not grant Premium retention or intelligent insights.

Exam traps

• Licensing the tenant with a single E5 seat does not give every mailbox one-year retention.
• Premium is not eDiscovery, not Activity explorer, and not a content hold.
• Custom audit log retention policies are a Premium capability; Standard-only tenants cannot create them.
• Disabling the Advanced Auditing app silently drops intelligent insights even when the E5 SKU remains assigned.
• MailItemsAccessed can appear for E3 mailboxes; the SensitivityLabel insight is the Premium piece.

Official resources

• Learn about auditing solutions in Microsoft Purview — Standard vs Premium comparison and licensing notes (updated 2026-05-18)
• Get started with auditing solutions — license assignment and Advanced Auditing app steps (updated 2026-02-18)
• Microsoft Purview service description — SKU matrix for Audit Standard and Premium (updated 2026-08-03)