Identify Retention Label Changes in Microsoft Purview

SC-401 By islever Editorial Last updated

Implement and manage retention

Short answer

B Use Activity Explorer in the Microsoft Purview portal to view a historical record of retention label changes.

Question

You have a Microsoft 365 subscription that uses retention label policies.
You need to identify all the changes made to retention labels during the last 30 days.
What should you use in the Microsoft Purview portal?
  1. Reports
  2. Activity explorer Correct Answer
  3. Content search
  4. Use data search

Key Takeaways

The question tests knowledge of auditing tools for retention labels. The common trap is confusing 'Reports' or 'Content Search' with the real-time activity log provided by Activity Explorer.

To identify all changes made to retention labels within a specific timeframe, use the Activity Explorer in the Microsoft Purview portal. This tool provides a historical view of label-related activities.

Common mistake: Many candidates incorrectly choose 'Reports', assuming it covers detailed label change history. However, Reports typically provide aggregate statistics rather than a chronological list of specific label modification events.

Expert Analysis

Why the Answer Is Correct

The correct answer is B, Activity Explorer. According to Microsoft documentation, Activity Explorer in the Microsoft Purview compliance portal provides a historical view of activities related to labeled content. It specifically tracks events such as when a retention label was applied, changed, or removed. The tool allows administrators to filter and view these activities over a specified period, such as the last 30 days mentioned in the scenario.

Why the Other Options Are Wrong

Option A (Reports) generally offers summary data and trends rather than a granular list of individual label change events. Option C (Content Search) is used to search for and preserve content based on criteria, not to audit policy or label configuration changes. Option D (Data Search) is primarily for finding sensitive data across locations, not for tracking administrative actions like label modifications.

Community Comment Notes

The community consensus strongly supports Activity Explorer. One user noted, "Activity explorer in Microsoft Purview provides a historical view of activities related to labeled content." Another highlighted that it includes events like "Retention label changed," which directly addresses the requirement to identify changes.

Official Reference

https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer

This link opens the official vendor documentation in a new tab.

Exam Strategy

When questions ask about tracking specific user or admin activities (like label changes) over a recent period, look for 'Activity Explorer' or 'Audit Log'. Reserve 'Content Search' for finding actual data items.

Frequently Asked Questions

Can Content Search show who changed a retention label?

No, Content Search finds content items. It does not provide an audit trail of administrative actions like label policy changes.

How far back does Activity Explorer retain data?

Activity Explorer typically retains data for up to 90 days, but the question specifies looking at the last 30 days, which is well within this window.

More SC-401 FAQ →

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. 454252dfr 👍 8 Answered B
    Correct
  2. 6b5b744 👍 4 Answered A
    A is correct because the question is asking about changes to the labels, not changes to the retention labeled content. Trick question,
  3. Eltooth 👍 4 Answered B
    B is correct answer.
  4. rvln7 👍 2 Answered B
    correct: https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer
  5. NeerajSap 👍 1 Answered B
    Activity explorer in Microsoft Purview provides a historical view of activities related to labeled content and reports on up to 30 days of data. It includes events such as: Retention label applied Retention label changed Retention label removed
Show 1 more comment
  1. spgrinch 👍 1 Answered B
    whenever a question is about label activity specifically (not general admin/audit events, not content location), and gives you a lookback window that's 30 days or less, Activity Explorer is very likely the intended answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Sensitivity Labels to Restrict Microsoft 365 Copilot Access

S-grade

Microsoft Purview Retention Policy Conflict Resolution

S-grade

Maximum Primary Elements in Microsoft Purview EDM Classifier

S-grade

Encrypting Emails with Azure Storage Keys via DLP

S-grade

← Back to SC-401 Study Guide