How Do Purview Audit Retention Policy Priorities Apply to User Actions?
HOTSPOT
You have a Microsoft 365 E5 subscription that uses Microsoft Purview Audit (Premium) with the 10-Year Audit Log Retention add-on license.
The subscription contains the audit retention policies shown in the following table.
From the SharePoint Online admin center, User1 performs the actions shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Community Insight
The exam tests whether you can match each SharePoint action to every applicable audit retention policy and then apply Purview's priority rule, where the lowest number outranks duration and broader 'all activities' scopes.
This SC-401 hotspot tests Microsoft Purview Audit (Premium) retention policy precedence when multiple policies cover SharePoint Online actions by User1. The page establishes the correct Yes/No selections: Action1 No, Action2 Yes, and Action3 Yes, based on the lowest priority number winning.
Learners often assume the longest retention duration wins or that the highest-priority policy controls every action, instead of first filtering policies by activity scope and then selecting the lowest priority number.
Community Discussion (11 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The statements resolve to No, Yes, Yes because Purview Audit (Premium) evaluates each action against every retention policy whose service/activity scope matches, then applies the policy with the lowest priority number. Action1, archiving a site, is not covered by RP4, so the broad RP2 policy with a three-year duration controls it, making the one-year statement false. Action2, creating a site collection, matches RP1, RP2, and RP3, but RP2's priority 20 outranks RP1's 30 and RP3's 40, so the three-year statement is true. Action3 matches RP4 at priority 10 and RP2 at priority 20; because 10 is higher priority, RP4's six-month retention wins, making the six-month statement true.Why Other Candidate Answers Are Wrong
A No/No/Yes pattern fails because it ignores RP2's 'None/All' scope for Action2; once RP2 is recognized as covering all SharePoint activities, its priority 20 beats RP1 and RP3 for the site-collection creation. A No/Yes/No pattern fails because it treats RP2 as higher priority than RP4; numerically RP4's priority 10 is the highest priority, so Action3 cannot fall back to RP2's three-year duration. The longest-duration argument is also wrong for audit retention policies: Purview applies policy priority first, not the longest configured retention. Confusing content retention's longest-period rule with audit retention precedence is the main source of the N/Y/N and N/N/Y variants.Community Comment Notes
florinvele's highly upvoted breakdown reaches the same No/Yes/Yes result, explaining that "Action3 is retained 6 months based on RP4" and that RP4 "does not include" the first action. rvln7 walks through the same policy matching for Action1 and Action2, tying the site-archive action to RP2 and the site-collection creation to RP2's priority 20. kollyp2000 clarifies that RP2's "None" scope means "every SharePoint activity by User1," which is essential for rejecting the No/No/Yes reading. Ender3 questioned whether a longer duration overrides priority and pointed back to Microsoft's priority documentation, while Alcpt's later comments illustrate how easy it is to invert RP2 and RP4's precedence.Official Reference
Exam Strategy
Read each action separately, list every policy whose service/activity scope includes it, then discard all but the lowest priority number. Do not compare durations until you have applied the priority rule; a broad 'None/All activities' policy applies unless a more specific higher-priority policy covers the same action.
Frequently Asked Questions
Why does Action3 use RP4's six-month retention instead of RP2's three-year retention?
RP4 has priority 10, a lower number than RP2's priority 20, so RP4 takes precedence for actions it covers. Purview audit retention policy priority overrides a broader all-activities policy with a longer duration.
Does an audit retention policy with 'None' activities apply to all SharePoint actions?
Yes, in this scenario RP2's None/All scope covers every SharePoint activity by User1. It applies unless a higher-priority policy such as RP4 specifically covers the same action.