You create a new Microsoft 365 subscription and assign Microsoft 365 E3 licenses to 100 users.
From the Security & Compliance admin center, you enable auditing.
You are planning the auditing strategy.
Which three activities will be audited by default? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
By default, when auditing is enabled in the Security & Compliance Center for Microsoft 365, the following activities will be audited: creation of a new SharePoint site collection by an administrator, creation of a new mail flow rule by an administrator, and a user sharing a SharePoint folder with an external user. These events are typical of the default auditing settings in Microsoft 365. Activities related to mailbox permissions and message purging are not audited by default unless mailbox audit logging is specifically enabled, which is not the case for E3 licenses.
From the link: "Although mailbox audit logging on by default is enabled for all organizations, only users with E5 licenses will return mailbox audit log events in audit log searches in the Security & Compliance Center or via the Office 365 Management Activity API by default." As the question says they only have E3 licenses, user actions on their mailboxes are not logged by default.
ABC - mailbox audit only goes for E5 users
testing voting comment end of test.
Answer should be ABC, since user actions are not logged by default with an E3 license as described before. Actions ABC are audited as described on https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide#audited-activities
Just as additional info: Mailbox auditing can be activated for E3 as well (but it's not default). https://docs.microsoft.com/en-us/microsoft-365/compliance/enable-mailbox-auditing?view=o365-worldwide#more-information
Admin activity in Exchange Online (Exchange admin audit logging) Admin activity in SharePoint Online User activity in SharePoint Online and OneDrive for Business
Searched in the referenced doc and found "Created Site Collection", "Added delegate mailbox permissions" and "Removed delegate mailbox permissions", "Purged messages from the mailbox". So the answer should be A, D, E.
Took another look. Answer should be A, B, C, since mailbox auditing not enabled for users with E3 license by default. https://docs.microsoft.com/en-us/microsoft-365/compliance/enable-mailbox-auditing?view=o365-worldwide#more-information