Microsoft Purview Activity Explorer for DLP and Label Reports
You have a Microsoft 365 E5 tenant that has data loss prevention (DLP) policies. You need to create a report that includes the following: • Documents that have a matched DLP policy. • Documents that have had a sensitivity label changed. • Documents that have had a sensitivity label changed. What should you use?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of Microsoft Purview monitoring tools, specifically distinguishing between auditing/reporting (Activity Explorer) and search/retrieval (Content Search). The common trap is selecting Content Search, which is used for finding specific items rather than generating activity reports.
Activity Explorer is the correct tool to monitor and report on DLP policy matches and sensitivity label changes within Microsoft 365. This solution provides a centralized dashboard for tracking content-related activities without requiring eDiscovery or content search procedures.
Learners often select 'Content Search' because it can find documents with specific labels. However, Content Search is an investigation and retention tool, not an activity monitoring or reporting dashboard for general compliance trends like label changes.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Activity Explorer in Microsoft Purview is designed specifically to provide visibility into user activities related to sensitive information. It tracks events such as DLP policy matches and sensitivity label modifications, allowing administrators to generate reports on these activities. As noted by community member SDiwan, the interface explicitly states it reviews "activity related to content that contains sensitive info or has labels applied," which directly aligns with the requirement.Why the Other Options Are Wrong
Content Search (Option A) is used to locate and preserve content across workloads but does not serve as an activity monitoring report generator for general trends. An eDiscovery case (Option B) is a legal hold and collection process, not a routine monitoring tool. Communication Compliance (Option C) focuses on analyzing messages for policy violations, not tracking document label changes or DLP matches in files.Community Comment Notes
Community consensus strongly supports Activity Explorer. User SDiwan highlighted the specific heading in the compliance portal that confirms its capability to review label changes and file modifications. User thetootall emphasized that since the goal is reporting rather than content retrieval or legal hold, Activity Explorer is the appropriate choice over Content Search.Official Reference
Exam Strategy
When asked about monitoring or reporting on user activities regarding sensitive data or labels, always consider Activity Explorer first. Reserve Content Search and eDiscovery for scenarios involving legal holds, specific content retrieval, or preservation needs.
Frequently Asked Questions
Can Content Search generate a report of all label changes?
No, Content Search finds specific items based on criteria. It does not provide an activity log or trend report of label changes across the tenant.
Is Activity Explorer part of the free trial?
Activity Explorer is available in Microsoft 365 E5 and G5 tenants, as well as standalone Purview plans, providing comprehensive audit and activity insights.