Activity Explorer & Data Monitoring

Your data monitoring toolkit

Content Explorer — what data do you have?

Content Explorer lets you browse sensitive content discovered across your tenant:

What It Shows	Example
Sensitive info type matches	847 documents with credit card numbers
Sensitivity label distribution	2,400 files labelled Confidential, 180 labelled Highly Confidential
Trainable classifier matches	95 documents classified as “Contracts” by AI
Location breakdown	Finance SharePoint: 340 sensitive docs. HR SharePoint: 210 sensitive docs

Key exam concept: Content Explorer answers “WHAT sensitive data do we have and WHERE?” — it’s the discovery tool. You use it BEFORE setting up DLP policies to understand what you need to protect.

Activity Explorer — what’s happening to your data?

Activity Explorer shows real-time data about user activities:

Activity Type	What It Tracks
Labelling	Sensitivity labels applied, changed, or removed
DLP matches	Policies triggered, actions taken (warn, block)
File activities	Copies, moves, downloads, prints, uploads
Sharing	Internal and external sharing events
Endpoint activities	USB copies, cloud uploads from devices

💡 Scenario: Priya investigates a data trend

Priya (Northwave’s Compliance Officer) uses Activity Explorer weekly:

This week’s findings:

• 📈 47 “label removed” events (users removing Confidential labels before sharing)
• 🔴 12 DLP blocks (mostly Marketing sharing campaign data externally)
• 📋 3 files copied to USB drives (flagged by endpoint DLP)
• ⚠️ 1 user removed labels on 15 documents in one hour

Actions:

• Investigate the label-removal trend → are users deliberately bypassing protection?
• Review DLP blocks with Marketing → are the policies too strict, or is there a real risk?
• Follow up on the USB copy events → is this an authorised data transfer?
• Escalate the single-user label removal → possible Insider Risk case

Alerts across Purview tools

Each Purview tool generates its own alerts:

Alert sources in Microsoft Purview

Alert Source	What Triggers It	Where to Review
DLP alerts	Sensitive data sharing matches a DLP policy	Purview → DLP → Alerts
Insider Risk alerts	User behaviour matches a risk pattern	Purview → Insider Risk → Alerts
Communication Compliance alerts	Message content matches a compliance policy	Purview → Communication Compliance → Alerts
DSPM for AI alerts	Sensitive data accessed via AI tools	Purview → DSPM for AI

The alert lifecycle

1. Triggered → automatic based on policy match
2. Review → admin investigates the alert details
3. Action → resolve, escalate, dismiss as false positive
4. Close → mark as resolved with resolution notes

🎬 Video walkthrough

Flashcards

Question

What's the difference between Content Explorer and Activity Explorer?

Click or press Enter to reveal answer

Answer

Content Explorer shows WHAT sensitive data exists and WHERE (inventory). Activity Explorer shows WHAT'S HAPPENING to that data — labelling, sharing, DLP events, file activities (real-time monitoring).

Click to flip back

Show hint

Question

Where do you review DLP alerts?

Click or press Enter to reveal answer

Answer

Microsoft Purview → Data Loss Prevention → Alerts. Each alert shows what was detected, who triggered it, which policy matched, and what action was taken (warn, block, audit).

Click to flip back

Knowledge Check

Knowledge Check

Priya wants to understand what types of sensitive data exist across Northwave's SharePoint sites BEFORE creating DLP policies. Which tool should she use first?

AActivity Explorer — to see what data is being sharedBContent Explorer — to discover and catalogue sensitive data across the tenantCDLP alerts — to see what's already being caughtDDSPM for AI — to see what data Copilot is accessing

Check Answer

---

Next up: Oversharing in SharePoint — the #1 risk for Copilot deployments and the tools to detect and fix it.