Managing Microsoft 365 DLP Alert Status Lifecycle

SC-401 By islever Editorial Last updated

Manage information security alerts and activities

Short answer

E You can change the status of a Resolved DLP alert to Investigating, Active, or Dismissed to reflect ongoing or revised investigation needs.

Question

You have a Microsoft 365 alert named Alert2 as shown in the following exhibit.
Exhibit: Managing Microsoft 365 DLP Alert Status Lifecycle
You need to manage the status of Alert2.
To which status can you change Alert2?
  1. The status cannot be changed.
  2. Dismissed only
  3. Investigating only
  4. Active or Investigating only
  5. Investigating, Active, or Dismissed Correct Answer

Key Takeaways

The core concept tested is the flexibility of the alert workflow in Microsoft 365 Defender, where a 'Resolved' status is not final and can be reverted to Active, Investigating, or Dismissed.

This question addresses the lifecycle management of Microsoft Purview DLP alerts, specifically focusing on the ability to modify an alert's status from 'Resolved' back to other states. It establishes that users can reopen or dismiss resolved alerts based on new information.

Common mistake: Many candidates incorrectly assume that once an alert is marked as 'Resolved', its status is locked and cannot be changed (Option A), failing to recognize the need for re-investigation or false positive correction.

Expert Analysis

Why the Answer Is Correct

In Microsoft Purview (formerly Compliance Manager) and Microsoft 365 Defender, the lifecycle of a Data Loss Prevention (DLP) alert allows for dynamic status updates. While an alert typically moves through states like Active -> Investigating -> Resolved, the system permits users to change the status of a Resolved alert if necessary. Specifically, you can change a resolved alert to Active (to reopen it for further investigation), Investigating (if it requires immediate attention again), or Dismissed (if it was a false positive or irrelevant). Therefore, all three statuses are valid targets for modification.

Why the Other Options Are Wrong

Option A is incorrect because the UI explicitly provides buttons or dropdowns to change the status of a resolved alert. Options B and C are incomplete; while you can dismiss or investigate, you are not limited to only one of those actions. Option D excludes 'Dismissed', which is a common action for resolved false positives, making it an incorrect constraint.

Community Comment Notes

Community consensus strongly supports Option E. As user f2b34cb noted, "You can change a resolved alert in 365 DLP to the Dismissed or Active status." User Alcpt confirmed this by stating, "Yes, you can change a Resolved alert's status back to Active, Investigating (or In Progress), or Dismissed within the Microsoft 365 portals." This aligns with official Microsoft documentation describing the alert workflow stages.

Official Reference

https://learn.microsoft.com/en-us/purview/compliance-manager-alert-policies

This link opens the official vendor documentation in a new tab.

Exam Strategy

When dealing with Microsoft Purview alert questions, remember that 'Resolved' is a state that can be reversed. Do not assume 'Resolved' means 'Final'. Look for options that allow reopening (Active/Investigating) or dismissing, as these are standard operational needs in security incident response.

Frequently Asked Questions

Why can't I change a Resolved alert to anything else?

You can actually change it. Microsoft Purview allows reverting a Resolved alert to Active or Investigating if new evidence emerges, or to Dismissed if it was a false positive.

What is the difference between Dismissed and Resolved?

Resolved means the issue is handled but might still be relevant. Dismissed means the alert is irrelevant or a false positive. Both are terminal states, but Resolved can be reopened.

More SC-401 FAQ →

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. f2b34cb 👍 5 Answered E
    You can change a resolved alert in 365 DLP to the Dismissed or Active status. While the standard workflow moves an alert to a "resolved" state when it's handled, you can also dismiss it if it's not relevant or reopen it to an active status if further action is needed. Dismissed: Use this status if the alert is not relevant, was a false positive, or has already been dealt with in a way that doesn't require further investigation. Active: Revert an alert to this status if a review reveals that it was incorrectly resolved and requires more action. Investigating: This is a status to use when you are actively working on the alert.
  2. rvln7 👍 4 Answered E
    correct: https://learn.microsoft.com/en-us/purview/compliance-manager-alert-policies
  3. 454252dfr 👍 3 Answered E
    Correct
  4. Alcpt 👍 2
    Updating my answer to E Yes, you can change a Resolved alert's status back to Active, Investigating (or In Progress), or Dismissed within the Microsoft 365 portals. While "Resolved" signifies that an investigation is complete, you might need to change the status if new information emerges or if the issue recurs
  5. Eltooth 👍 1 Answered A
    There is no clear answer to this as the official MS documentation has changed. "The official Microsoft documentation on the lifecycle of DLP alerts does not explicitly state that a resolved alert can never be reopened or changed to another status. However, it does describe the process as moving through stages like Trigger → Notify → Triage → Investigate → Remediate → Tune, and once remediation is complete, the alert is considered closed. The documentation emphasizes that the Microsoft Defender portal retains incidents for six months, and the DLP alert management dashboard retains alerts for 30 days, but it does not mention an option to revert a resolved alert back to an active state.1 So, while the statement you provided is mostly accurate in practice (resolved alerts are treated as final), Microsoft does not explicitly say “cannot be reopened” in the docs. It’s more about the workflow being designed for forward progression rather than reopening."
Show 3 more comments
  1. spgrinch 👍 1 Answered E
    When an alert is created, its status is Active. As you review the details of each alert, you can update its status to any of the states listed below: Active: default state of the alert until its status is changed Investigating: alert is under investigation Resolved: the alert doesn't require further investigation or follow-up Dismissed: the alert isn't relevant or doesn't need investigation
  2. NeerajSap 👍 1 Answered E
    In Microsoft 365 (Microsoft Purview/Defender alert management), an alert's status can be changed among the available alert states to reflect its investigation lifecycle. Even if the current status of Alert2 is Resolved (as shown in the exam exhibit), you can change it back to: Active Investigating Dismissed
  3. Alcpt 👍 1 Answered A
    A resolved alert will not change its status, but the associated alert policy can still create new alerts if the triggering conditions are met again.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Sensitivity Labels to Restrict Microsoft 365 Copilot Access

S-grade

Microsoft Purview Retention Policy Conflict Resolution

S-grade

Maximum Primary Elements in Microsoft Purview EDM Classifier

S-grade

Encrypting Emails with Azure Storage Keys via DLP

S-grade

← Back to SC-401 Study Guide