Explanation:

In Microsoft Purview , permissions to perform searches, audits, and investigations are managed through role groups within the Microsoft Purview compliance portal . Each role group provides specific capabilities aligned with least privilege principles.
User1 - Search Audit Logs and Review Configuration To allow a user to:
* Search the Microsoft Purview Audit logs , and
* Review the Audit configuration and settings ,
...the required role group is Audit Reader .
According to Microsoft documentation:
"Members of the Audit Reader role group can search the audit log for user and admin activities and view audit configuration settings." This group grants audit-related permissions only - it does not grant access to other Purview or mailbox content, meeting the least privilege requirement.
# User1 = Audit Reader
User2 - Search Exchange Online Mailboxes To allow a user to:
* Perform content searches across Microsoft Exchange Online mailboxes ,
...the correct role group is Data Investigator .
Per Microsoft Purview documentation:
"Members of the Data Investigator role group can perform content searches across Exchange Online, SharePoint Online, and OneDrive locations." Other options such as Communication Compliance Investigators or Insider Risk Management Investigators are specific to their respective Purview solutions and not used for general content or mailbox searches.
# User2 = Data Investigator