Microsoft Purview compliance portal: OCR Audit logs

🚨 The Signal: Microsoft Purview now provides audit logs for Optical Character Recognition (OCR) transactions within Exchange and Teams. This enhances visibility into content processing, aiding in forensic investigations and compliance.

The Impact

Security teams and compliance officers are affected, gaining enhanced visibility into OCR processing risks.

• Security Teams: Improved forensic capabilities for content processed by OCR.
• Compliance Officers: Better audit trails for regulatory and policy adherence.
• Data Owners: Increased transparency on how their data is handled by OCR.
• Incident Responders: More detailed logs for investigating data exfiltration or misuse.

The Action

1. Review Purview audit log retention policies to ensure OCR logs are captured.
2. Integrate OCR audit logs into existing SIEM solutions for centralised monitoring.
3. Update incident response playbooks to include OCR audit log analysis.
4. Communicate enhanced OCR auditing capabilities to relevant stakeholders.

Impact: medium · Workload: Microsoft Purview