Microsoft 365 Administrator — Question 360

You have a Microsoft 365 E5 subscription.

You need to recommend a solution for monitoring and reporting application access. The solution must meet the following requirements:

• Support KQL for querying data.
• Retain report data for at least one year.

What should you include in the recommendation?

Answer options

• A. a security report in Microsoft 365 Defender
• B. Endpoint analytics
• C. Microsoft 365 usage analytics
• D. Azure Monitor workbooks

Correct answer: D

Explanation

The correct choice is D, Azure Monitor workbooks, as they support KQL for querying and can retain data for over a year. Option A, while offering security insights, does not specifically mention KQL support or data retention duration. Options B and C do not meet the requirement for KQL usage, making them unsuitable choices.