Step 1 – Scenario
You need to grant User1 permission to search Microsoft 365 audit logs while following the principle of least privilege.
Step 2 – Roles that can search audit logs
Audit log search in Microsoft 365 is tied to Exchange Online role groups, because audit log data is stored in Exchange.
The following roles are relevant:
View-Only Audit Logs → Grants the ability to search and view audit logs, but not configure auditing or take other compliance actions. This is the least privilege role.
Audit Logs → Grants broader permissions, including turning auditing on/off.
Compliance Management → A broader role group that includes audit log search and many other compliance functions, violating least privilege.
Security Reader (Entra ID) → Grants read-only access to security features, but not audit logs.
Reviewer (Purview) → Used in eDiscovery, not audit logs.
Step 3 – Why " View-Only Audit Logs " is correct
According to Microsoft documentation:
“Users must be assigned the Audit Logs or View-Only Audit Logs role in Exchange Online to search the audit log. To minimize permissions, assign View-Only Audit Logs.”
???? Reference: Permissions required to search the audit log
Step 4 – Elimination of other options
A. Security Reader role → Allows reading security-related info in Microsoft 365 Defender, not Purview audit logs.
B. Compliance Management role → Includes more than just audit logs, not least privilege.
C. View-Only Audit Logs role → Correct and least privilege.
D. Reviewer role → For eDiscovery cases, not audit logs.
