The Microsoft Purview audit log (also known as the unified audit log) is the correct tool for this investigation. It is designed to capture user and administrator activities across various Microsoft 365 services, including SharePoint Online and Exchange Online, in a single, searchable location. The admin can filter the log by date range, specific users, and activities such as "Changed sharing policy" for SharePoint or Exchange admin audit log events like running a specific cmdlet. This provides a comprehensive view of the required activities in one place.

A. Microsoft Entra sign-in logs only track user authentication events (sign-ins), not specific actions performed within services like SharePoint or Exchange.

B. The Azure Monitor activity log tracks subscription-level events for Azure resources (like creating a VM), not user activities within Microsoft 365 services.

C. The SharePoint site usage report provides analytics on views and traffic but does not contain detailed audit trail information about permission or setting changes.

1. Microsoft Purview Documentation. (2024). Learn about Microsoft Purview Audit (Standard). Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/audit-standard-learn. (See the "Audited activities" section, which lists SharePoint and Exchange Online as covered services, and the "Search the audit log" section, which describes its function as the central tool).

2. Microsoft Purview Documentation. (2024). Search the audit log in the Microsoft Purview compliance portal. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/audit-log-search. (This document provides the exact procedure for using the tool, including filtering by "Activities," "Users," and "Date range," matching the scenario's requirements).

3. Microsoft SharePoint Documentation. (2024). SharePoint auditing activities. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/audit-log-sharepoint-activities. (This page lists specific SharePoint activities, like sharing and access request events, that are logged in the unified audit log).