You have a Microsoft 365 E5 subscription. You are implementing insider risk management. You need to maximize the amount of historical data that is…

In Microsoft Purview Insider Risk Management, the "Past activity detection" setting determines how far back in time the service will collect user activity data after a triggering event occurs. This setting is configured globally and applies to all insider risk management policies. The available options for this look-back period are 30, 60, or 90 days. To maximize the amount of historical data collected for analysis, an administrator must select the highest available value, which is 90 days. This provides the most extensive historical context for investigating potential insider risks.

A. 30 is a valid option for past activity detection, but it represents the minimum, not the maximum, duration for historical data collection.

B. 60 is a valid intermediate option for past activity detection, but it is not the maximum duration available.

D. 180 is not a supported value for the "Past activity detection" setting in insider risk management policies.

1. Microsoft. (n.d.). Get started with insider risk management settings. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/insider-risk-management-settings#policy-timeframes

Reference Details: In the "Policy timeframes" section, the documentation states, "This setting determines the period of time looking back from when a triggering event occurs for a user assigned to a policy. You can choose to collect activity for 30, 60, or 90 days."

2. Microsoft. (n.d.). Create and manage insider risk management policies. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/insider-risk-management-policies#policy-timeframes

Reference Details: The "Policy timeframes" section within this document reiterates the same configurable options: "Past activity detection: Choose how many days to look back for user activity after a trigger. You can choose 90 days, 60 days, or 30 days."