AB-900 lesson 6: Purview risk tools
Purview has several risk tools and each one is built around a different question, so choosing the right one starts with reading what the problem is actually about: data leaving a location (DLP), a person’s pattern of behaviour (Insider Risk Management), the words in messages (Communication Compliance), a view of past activity on labelled content (activity explorer), a regulatory scorecard (Compliance Manager), or locating items for a case (Content search in eDiscovery). Most wrong answers in this area are a good tool pointed at the wrong problem.
Tools that watch, and tools that look
It helps to split the tools into two groups. The first group is policy based: an admin creates a policy, and Purview raises alerts when something matches. DLP, Insider Risk Management and Communication Compliance all work this way. The second group is investigative: an admin opens the tool and looks. Activity explorer, the explorers in data classification, Compliance Manager and eDiscovery sit here.
The figure above gives the full mapping. The sections below explain the reasoning behind each line of it.
Data leaving: DLP
A data loss prevention policy chooses locations (Exchange, SharePoint, OneDrive, Teams chat and channel messages, endpoint devices, and others), conditions (a sensitive information type, a sensitivity label, sharing outside the organisation) and actions. Actions range from auditing, through a policy tip that warns the user, to blocking with or without an override. A new policy is best run in simulation mode first, where no actions are applied, so the impact can be tuned before enforcement.
For an admin the visible result is the DLP alert: an alert is created when a rule matches and incident reports are set to generate alerts. It appears in the DLP alerts dashboard in Purview and in the Microsoft Defender portal, where it is triaged, investigated and marked resolved. DLP can also target Microsoft 365 Copilot and Copilot Chat through its own policy location, for example to stop Copilot from processing items with a chosen sensitivity label; some of these Copilot controls are still in preview.
Risky behaviour of people: Insider Risk Management
Insider Risk Management looks for patterns of activity that suggest a leak, theft or policy violation, whether careless or deliberate. Policies are built from templates such as data theft by departing users, data leaks and risky AI usage. Some templates need extra signals; the departing-users template needs a trigger for the employment end date, either from an HR connector or from the deletion of the user’s Microsoft Entra account. Alerts open a case that reviewers triage, investigate and act on, and the solution is built with privacy in mind, with usernames pseudonymised by default. The focus is on the person’s activity over time rather than a single event.
Messages that break a policy: Communication Compliance
Communication Compliance reviews the text of communications: Exchange email, Teams chat and channels, Viva Engage, and Copilot prompts and responses. Templates detect inappropriate language, sensitive information, conflicts of interest or financial regulation terms. Reviewers resolve matches by tagging, notifying the user, escalating or removing a Teams message. Note that Global Administrators do not get access by default; permissions must be assigned deliberately.
Looking at activity and content
- Activity explorer shows what users did with labelled and sensitive content: labels applied, changed or removed, DLP rule matches, file reads. It covers up to 30 days and is not real time, since the data comes from the audit log and can take an hour or more to appear.
- Data explorer / content explorer views list where items carrying a label or a sensitive information type are stored. Microsoft’s documentation lists data explorer alongside the older content explorer (classic), and the AB-900 outline uses the name Data Explorer. Either way, the idea is the same: where does the sensitive content live?
- Compliance Manager measures posture against a regulation or standard. It combines assessments, controls and improvement actions into a compliance score, and improvement actions can be assigned and evidenced.
- Content search in eDiscovery finds email and files across mailboxes, SharePoint, OneDrive, Teams and groups, so they can be reviewed or exported. Classic eDiscovery experiences were retired in August 2025, so the current tool lives in the new eDiscovery experience of the Purview portal.
- DSPM for AI discovers AI activity and sensitive data in prompts and responses; lesson 7 covers it.
Worked example: a 200-person firm
Four things happen in one week. A user tries to email 80 customer card numbers to a personal address. A departing salesperson downloads far more files than usual. A manager reports abusive messages in a Teams channel. Legal asks for every email between two named people for a dispute.
The admin works through them in order. The card numbers are a DLP matter, and the alert is triaged in the DLP alerts dashboard. The unusual downloads belong to Insider Risk Management because the signal is behaviour over time. The abusive messages go to Communication Compliance, which reviews content. The legal request is a Content search, run as an eDiscovery task. Each tool answers a different noun: a leak, a person, a message, a case. Afterwards the admin opens Compliance Manager to see which improvement actions would close policy gaps.
Easy to confuse
| Looks similar | Difference |
|---|---|
| DLP alert and Insider Risk alert | DLP reacts to content and an action at a location; Insider Risk scores user activity patterns |
| Insider Risk and Communication Compliance | Activity signals versus message content |
| Activity explorer and Content search | Activity explorer shows past actions on labelled content; Content search finds the items themselves |
| Compliance Manager and DLP | A posture score against regulations versus enforcement on data |
| Content explorer and activity explorer | Where items are stored versus what users did with them |
Key points
- Pick the tool from the noun in the scenario: leak, person, message, regulation, case.
- DLP policies check conditions at locations and warn, block or audit; admins work the alerts.
- Insider Risk Management scores user activity and opens cases; some templates need extra signals such as an HR connector.
- Communication Compliance reviews message content, including Copilot interactions, and needs explicit permissions.
- Activity explorer covers up to 30 days and lags the audit log.
- Compliance Manager gives a compliance score driven by improvement actions.
Check yourself
Question 1. A company wants to be told when an employee who has resigned starts copying an unusual number of project files to external storage. Which solution is designed for this?
- A. A DLP policy for OneDrive
- B. An Insider Risk Management policy based on the departing user template
- C. A Communication Compliance policy
- D. A Compliance Manager assessment
Show answer
Answer: B
Insider Risk Management has a template for data theft by departing users and scores activity over time. DLP would react to specific content or sharing rules but is not built around a person’s behaviour pattern. Communication Compliance reviews message text. Compliance Manager scores regulatory posture and does not watch users.
Want more questions like this? Full AB-900 practice tests →
Question 2. The compliance officer wants to see, over the last few weeks, how often users removed or downgraded sensitivity labels on files. Which tool shows this?
- A. eDiscovery Content search
- B. Compliance Manager
- C. A retention policy report
- D. Activity explorer
Show answer
Answer: D
Activity explorer reports label applied, changed and removed events, with up to 30 days of data. Content search finds items but does not show activity trends. Compliance Manager measures regulatory controls. A retention policy keeps or deletes content.
Want more questions like this? Full AB-900 practice tests →
Question 3. An organisation wants a recurring score that shows progress against a data protection regulation, with tasks it can assign to colleagues. What should it use?
- A. Compliance Manager
- B. Activity explorer
- C. Communication Compliance
- D. Insider Risk Management
Show answer
Answer: A
Compliance Manager provides assessments for regulations, improvement actions that can be assigned and documented, and a compliance score. Activity explorer shows user actions on content. Communication Compliance reviews messages. Insider Risk Management detects risky behaviour, not regulatory progress.
Want more questions like this? Full AB-900 practice tests →
This lesson covers the risk-identification part of the data protection and governance domain of AB-900 (35-40% of the exam); the recap in AB-900 data protection and governance condenses it, and the topic pages on DLP, Insider Risk Management and Purview eDiscovery go deeper.