Microsoft Purview Activity Explorer for DLP and Label Reports
Short answer
D Use Activity Explorer to create a report on DLP policy matches and sensitivity label changes.
Question
Key Takeaways
The question tests knowledge of Microsoft Purview monitoring tools, specifically distinguishing between auditing/reporting (Activity Explorer) and search/retrieval (Content Search). The common trap is selecting Content Search, which is used for finding specific items rather than generating activity reports.
Activity Explorer is the correct tool to monitor and report on DLP policy matches and sensitivity label changes within Microsoft 365. This solution provides a centralized dashboard for tracking content-related activities without requiring eDiscovery or content search procedures.
Common mistake: Learners often select 'Content Search' because it can find documents with specific labels. However, Content Search is an investigation and retention tool, not an activity monitoring or reporting dashboard for general compliance trends like label changes.
Expert Analysis
Why the Answer Is Correct
Activity Explorer in Microsoft Purview is designed specifically to provide visibility into user activities related to sensitive information. It tracks events such as DLP policy matches and sensitivity label modifications, allowing administrators to generate reports on these activities. As noted by community member SDiwan, the interface explicitly states it reviews "activity related to content that contains sensitive info or has labels applied," which directly aligns with the requirement.
Why the Other Options Are Wrong
Content Search (Option A) is used to locate and preserve content across workloads but does not serve as an activity monitoring report generator for general trends. An eDiscovery case (Option B) is a legal hold and collection process, not a routine monitoring tool. Communication Compliance (Option C) focuses on analyzing messages for policy violations, not tracking document label changes or DLP matches in files.
Community Comment Notes
Community consensus strongly supports Activity Explorer. User SDiwan highlighted the specific heading in the compliance portal that confirms its capability to review label changes and file modifications. User thetootall emphasized that since the goal is reporting rather than content retrieval or legal hold, Activity Explorer is the appropriate choice over Content Search.
Exam Strategy
When asked about monitoring or reporting on user activities regarding sensitive data or labels, always consider Activity Explorer first. Reserve Content Search and eDiscovery for scenarios involving legal holds, specific content retrieval, or preservation needs.
Frequently Asked Questions
Can Content Search generate a report of all label changes?
Is Activity Explorer part of the free trial?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
SDiwan 👍 5 Answered DActivity explorer page has below heading in compliance portal : "Review activity related to content that contains sensitive info or has labels applied, such as what labels were changed, files were modified, and more. " . It matches with the question.
-
thetootall 👍 1 Answered DActivity explorer will allow us to create a report. We don't need to view content, or review communications. Were also not trying to put data on hold doing initial due diligance
-
mb0812 👍 1 Answered AContent search is required
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.