Purview investigation tools: audit log vs content vs Graph logs
This sheet compares Search-UnifiedAuditLog, Content search (eDiscovery), Graph activity logs, Audit Premium insights.
| Criterion | Search-UnifiedAuditLog | Content search (eDiscovery) | Graph activity logs | Audit Premium insights |
|---|---|---|---|---|
| Returns | Audit records via script | Actual content across sources | Every Graph HTTP request | Sensitivity label on mail access |
The verdict, the full comparison, 4 rules and 2 traps are part of SC-200 access. Unlock SC-200.