SC-401 practice question 6 of 25

You have a Microsoft 365 E5 subscription that uses retention label policies. You need to identify all the changes made to retention labels during the…

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Implement information protection

You have a Microsoft 365 E5 subscription that uses retention label policies. You need to identify all the changes made to retention labels during the last 30 days. What should you use in the Microsoft Purview portal?

Answer options

Correct Answer:

Explanation

Activity explorer in the Microsoft Purview portal is the designated tool for monitoring activities related to information protection and data governance labels. It provides a detailed, historical view of actions, including the creation, modification, and deletion of retention labels. By filtering for "Retention label" activities within a specific date range, an administrator can precisely identify all changes made to these labels, directly fulfilling the requirement of the question.

Why Incorrect

A. Reports: The Reports section provides high-level, aggregated summaries and visualizations of label usage, but it does not offer a detailed audit log of administrative changes to the labels themselves.

C. User data search: This tool is designed to find and manage data associated with a specific user to fulfill Data Subject Requests (DSRs) under privacy regulations like GDPR, not for auditing administrative configurations.

D. Content search: This is an eDiscovery tool used to search for and export content (such as emails and documents) from Microsoft 365 locations, not to track changes made to compliance objects like retention labels.

---

References

1. Microsoft Learn. "Get started with activity explorer." Microsoft Purview documentation. This document states, "You can also use activity explorer to view activities related to retention labels that are applied to content across SharePoint, OneDrive, and Exchange." It lists specific auditable activities including Retention label created, Retention label updated, and Retention label deleted.

2. Microsoft Learn. "Learn about the audit log in Microsoft Purview." Microsoft Purview documentation. This document details the activities logged by Microsoft 365. While the audit log is the underlying source, Activity Explorer is the specialized interface presented as an option for viewing label-specific activities. The section on "Data governance activities" lists "Changed retention label" as a logged event.

3. Microsoft Learn. "Get started with Content search." Microsoft Purview documentation. This source clarifies the purpose of Content Search: "Use the Content search eDiscovery tool in the Microsoft Purview compliance portal to search for content such as email, documents, and instant messaging conversations in your organization." This confirms it is not for auditing administrative actions.

Question 6 of 25

Question breakdown

Tests: Monitor retention label activity
Difficulty: Medium

Key idea: Activity explorer gives a filterable history of labeling activities, including retention labels applied, changed, or removed on content, over a chosen time range.

How to reach the answer

The requirement is to see retention label changes over the last 30 days.
That calls for an activity history with date and activity filters, not summary charts or a content search.
Activity explorer records retention label events such as label applied, changed, and removed, and can be filtered to a 30-day window.
Reports give aggregated counts, user data search serves data subject requests, and content search finds items, so Activity explorer is the best fit.

Each option

AIncorrect. Reports show aggregated label usage, not an itemized history of label changes.
BCorrect. Activity explorer lists retention label activities with timestamps and supports filtering by activity type and date range.
CIncorrect. User data search locates a specific person's data for data subject requests and does not track label changes.
DIncorrect. Content search finds and exports content items; it does not report a timeline of label activity.

Common trap: Choosing Content search because it can query items by retention label, even though it shows current state rather than a history of changes.

In practice: Records managers use Activity explorer to check whether users are relabeling or removing retention labels on SharePoint and OneDrive items. Changes to the label definitions themselves would be investigated in the unified audit log.

Remember: For a time-bound history of label activity on content, go to Activity explorer; use Audit for administrative configuration changes.

Official documentation: Get started with activity explorer

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free SC-401 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test