Microsoft Purview Audit Reviews

I work with Defender for IoT by chance because I see that we have enough reviews for Defender for Office 365 today, and we need reviews for some Azure products. I work with Azure products such as Logic Apps, Synapse Analytics, and DevOps. I am working with Exchange today as well.

There is also Microsoft Azure Data Share, which is a data exchange service. I work with some other tools from Microsoft such as SharePoint, and I may also work with some smaller products for other use cases.

I work with some Microsoft Purview Audit aspects such as eDiscovery, for example, and PIM, which is Privileged Access Management. I use Microsoft Purview Audit for log management, and I use Purview Audit Log Search in almost all cases regarding security incidents. I do a little insider risk management and a little data protection.

Data retention is an important feature that I see benefits from. Especially when we talk about important cases for organizations of strategic importance, retention is very important. During the last four years, some organizations have lost their on-premises infrastructure and are going to Microsoft 365 cloud. When Microsoft scrapped their free licenses for Ukraine in 2024, it was a tragedy for some of these important organizations because they are mainly government or some near-government organizations with a limited budget. At the same time, they have to keep their data protected. For these organizations, it is very important to keep data retention. According to some legal requirements, they have to keep data for a few years. That is another problem because they do not have money to buy licenses to keep data for example during ten years and even longer. However, it is still important for them.

I have seen areas for improvement, specifically in Microsoft Purview Audit or in general about Microsoft. I have had a situation with documentation. I had a customer who wanted to create alerts and they had Microsoft 365 Business Premium. In the documentation, it was noted that this license is enough for creating alerts. When we tried to make them, we noticed they cannot do it with Microsoft 365 E3 because the customer had limited features to manage alerts. The customer had to buy E3. We created Microsoft support requests, and they confirmed that the documentation displayed not the real situation and they have been going to update documentation.

The same situation occurred now with implementing Microsoft Purview Audit in the last autumn. eDiscovery was combined with search and content search, and the documentation was not clear at the beginning. It was a little difficult to describe to customers that now it is a part of eDiscovery. Content search is a very simple functionality, while eDiscovery is a little difficult. I am not entirely sure why Microsoft is going in the way of combining these services because they are the same. However, for a customer who has never seen these services, it is difficult to understand quickly.

The same situation occurs with litigation holds and some other holds. For any mail, I am trying to keep data. For example, emails are held for a year or two years, ten years, it does not matter. It is difficult to understand where to find this data and where these emails are being held. I need to use eDiscovery to find out all deleted data that was kept somewhere in some hidden folders of the mailbox. Regular customers and regular administrators know that on-premises Exchange, for example, allows them to find the data in some repository and review the list of kept data. However, with this hold, we do not have any functionality to review the list of kept data. It is difficult to understand for customers how to work with this.

I had a case where I spent three or four hours working deeply with a customer to explain how to work with eDiscovery, why Content Search is not there when it was before, what is an eDiscovery case, and why we are talking about all of this just to review a list of kept emails. This is difficult.

I had some tasks three years ago and some a year ago. I have not had as many tasks as I would like to have, but I have had some.

There is some downtime.

Regarding scalability, I cannot say that it is easily scalable. There are some limits or it is expensive to scale. I am not ready to spend too much money, and I am not ready for these cloud dependencies. When I had on-premises infrastructure, I had some engineer who would take a soldering iron.

It is not very appropriate because it depends on the team. For example, the Dynamics team is excellent, and I mean only excellent teams. I am in love absolutely with that team. At the same time, talking about email cases, sometimes I can get very good support, and sometimes we are freezing on a simple question and I need to prove to an engineer that I am asking for indexing mailboxes on their site. I cannot say for certain because it depends on which team took my request.

I have used something similar not from Microsoft, but from other vendors. I know some popular vendors such as CrowdStrike and SentinelOne, or those products I never dealt with.

It is not so expensive in comparison with other products, but I can tell you about an example.

For example, Fortinet technologies and Microsoft technologies both cover all aspects of data protection such as mail protection and endpoint protection. Fortinet proposes point-by-point license, and I can plan a budget more flexibly than when I am working with Microsoft. Microsoft offers Office 365, Defender for Office 365, Intune, and Defender for Endpoint, and all of this is in some common difficult license which should be bought now. At the same time, Fortinet can propose FortiMail.

Microsoft Defender for Office 365 is a product that I still work with today, and I work with Microsoft products in general. There are multiple features in the product. For example, if we take alerting and real-time alerting, it does help to improve threat response absolutely. However, if I am not responsible for reviewing them and they are just delivered to my mailbox, that does not matter if I do nothing.

Microsoft Purview Audit Log Search standard is enough for basic customers' needs. It is enough and basically does what it is supposed to do. The main Microsoft feature is that it offers common integration of services, of data, of identity, meaning user accounts, user access, and privileged access. All the services are naturally integrated, and that is the most biggest plus.

My deployment model is different, and I have everything on cloud or I have hybrid or on-premises.

I rate this review as a nine out of ten.

Microsoft Purview Audit functions as a compliance center. Whenever these systems generate logs, we use Microsoft Purview Audit to capture or retrieve those logs. While there are more tools available through Microsoft Purview Audit, we primarily use it for the audit functionality. There is also a compliance element that we will likely leverage at some point, but currently, it's focused on log retrieval.

When logging into Microsoft Purview Audit and accessing the audit link, users can specify parameters such as date range, log types, and keywords. These parameters help refine the log data retrieval. It's fairly standard compared to other logging tools, but being part of the Microsoft suite makes it SaaS-based and easily accessible.

For our platform and any apps deployed into an environment or Dataverse, we enable audit logging and monitoring. Through the Power Platform Admin Center, when audit logging is configured for any Dataverse, those logs automatically get transported to Microsoft Purview Audit. While we are still in the early stages of using Microsoft Purview Audit for the current client, it will be increasingly leveraged over time.

From a service assessment and authorization process perspective, when conducting an assessment on an application or system, we use controls essentially equivalent to the NIST 800-53 framework. This includes examining audit logs, data quality, and various KPIs required for log configuration.

It factors into our application assessments. When producing documentation packages for application or system authorization, audit logging and monitoring are crucial parts of the assessment process. The evidence we gather includes screenshots and outputs from these tools and capabilities. For Microsoft Purview Audit specifically, we provide examples of audit function configuration and log output details, which are incorporated into our evidence documents.

We are still in the early stages of leveraging Microsoft Purview Audit. Currently, it's primarily used for the audit function. In a year's time, we will be able to provide more clarity and context on its usage.

I haven't engaged with Microsoft support directly regarding Microsoft Purview Audit. While we have support tickets for other matters accessible through Microsoft Purview Audit, I haven't engaged them specifically for Microsoft Purview Audit issues.

Negative

Regarding licensing, I'm not currently informed about the specifics, though it might be included in E5.

Microsoft Purview Audit was previously called Compliance Center. The functionalities have become richer since the rebranding. The assessments that could be generated from Compliance Center have been refined. The overall user experience with Microsoft Purview Audit is of higher quality than when it was branded as Compliance Center. Microsoft consistently updates and evolves functionalities and the overall experience.

On a scale of 1-10, I rate Microsoft Purview Audit an 8 out of 10.

I use the solution to secure, protect, and manage our Active Directory, and our Microsoft environment.

The PAM for Active Directory is good. 

ActiveOps is quite useful as a feature. 

The One Identity active role enables us to create a user in the cloud and give them access to resources through a single workflow. We can create rules-based access. It helps us control audit management and IT access management. We can decide what people can access and detect job functions.

It enables zero trust security with hybrid AD, find delegation, and role-based access control. It provides all certificates and provides secure authentication, call-based access control, et cetera. It's really important for my critical applications. We can see who's using what, whether they are authorized, and other information to decide what access to offer.

With the active role console, I can find out the obvious issues and also perform a decent setup.

The One Identity active roles enable us to reduce password reset times. We can handle tasks in a matter of a minute.

It simplifies AD and Azure AD management, efficiency, and security overall. The password manager is very secure and is a self-service password manager solution. It is considerably decreasing my help desk tasks. Our engineering users can reset forgotten passwords, and it can implement a stronger password. 

The management around access to enterprise resources keeps my data and systems secure.

We're easily saving at least one hour per day using this solution. 

The migration from AD to Azure AD is very easy. There are simple configurations, and the migration goes rather smoothly.

We use the solution support for SaaS apps through Cloud Delivered SCIM connectors. There are controls that can be configured and we can add and set permissions easily. 

We do have a Denial of Access happening.

I've used the solution for almost two years.

I'd rate the stability eight out of ten. The stability is very good. 

We currently have 2,000 users and two admins. We plan to use it even more in the future. 

Technical support is very good. 

Positive

We previously only used native Active Directory tools. This is more efficient.

The initial setup is easy. The deployment took about one day.

I'm not aware of the pricing of licensing terms. 

We did not evaluate other options before choosing this solution.

I'm a Microsoft customer.

We do not use the vendor's premier support option.

I'd advise others to first understand how to use a secure authentication system and why you need it. You need to understand what applications may be required and what kinds of access you'll need to give to each user.

I like that I can have a centralized solution for active management. 

I'd rate the solution nine out of ten.

We utilize Microsoft Purview Audit for monitoring security and compliance aspects. 

The platform has significantly enhanced our operational insight into the overall Microsoft 365 environment. It provides crucial metrics that help us understand our current position and how to progress. 

One of the significant pros of Microsoft Purview Audit is its user-friendly dashboards. These dashboards provide clear insights into the health of our Microsoft 365 environment. They allow us to monitor various products and their health statuses effectively. For instance, we can easily track updates and identify issues related to SharePoint, Microsoft Teams, Outlook, and other Microsoft applications.

Areas for product improvement include enhancing customization options and integrating more comprehensive compliance features.

The dashboards and all related setup functionalities are managed entirely by Microsoft. It provides essential information such as account maintenance status, security audits, threat intelligence reports, and core email solutions. 

I rate Microsoft Purview Audit a seven.