You are the IT administrator in a company with a Microsoft 365 subscription E3 subscription. You suspect that a colleague of yours – testadmin -have signed into Azure with malicious intent this morning. You need to perform an Audit log search from Security and Compliance Center for all User administration activities that he may have done this morning. 
You select todays date as start date, and set the start time to 00:00 
You select today as End date and set the current time as end time.
And set the Activites as shown: 

However the search results in no data. What should you do?

Answer options:

A.Search again after 24 hours.
B.Change the selected Activities
C.Change the start time, you cannot start the search at 00:00
D.Search again immediately, as searches might not always result in data.

Correct Answer: A 
when searching for events associated with Azure Active Directory admin events it might take up to 24 hours for the log audit record to be returned in the result of the log search. 
See Microsoft documentation: 

Option B is incorrect. You have selected the correct activities, but you may need to wait up to 24 hours before the search return any data. 
Option C is incorrect. This is not correct, you can start the search at 00:00
 Option D is incorrect. You may need to wait up to 24 hours before the search return any data. 
Reference:
To know more about audit log search, please refer to the link below: 

https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance?view=o365-worldwide