SC-900 Microsoft compliance solutions explained
Microsoft compliance solutions is 20–25% of SC-900. It covers the Service Trust Portal and Microsoft’s privacy principles, compliance management in the Microsoft Purview portal (Compliance Manager and compliance score), information protection and data lifecycle management (classification, sensitivity labels, data loss prevention, retention, records management), and insider risk, eDiscovery and audit. The exam asks you to match a data-protection need to the right Purview feature.
Service Trust Portal and privacy
The Service Trust Portal publishes Microsoft’s audit reports, compliance documents and certifications, so customers can check how Microsoft services meet standards. Microsoft’s privacy principles are control, transparency, security, strong legal protections, no content-based targeting and benefits to you. Know that customers control their data and Microsoft is transparent about its use.
Compliance Manager and compliance score
Compliance Manager in Purview assesses your compliance posture against regulations and standards, with assessments, improvement actions and templates. It produces a compliance score, a measure of progress toward the controls you track. Microsoft-managed actions and customer-managed actions both count, and the score is a guide, not a guarantee of legal compliance.
Information protection and data lifecycle
| Capability | What it does |
|---|---|
| Data classification | Finds and identifies sensitive data using sensitive information types and trainable classifiers; Content explorer shows items, Activity explorer shows what happened to them |
| Sensitivity labels and policies | Classify and protect content, with optional encryption, markings and access restrictions that travel with the file |
| Data loss prevention (DLP) | Detects sensitive content and blocks or warns on sharing |
| Retention policies and labels | Keep content for a set time, delete it after, or both |
| Records management | Declares items as records, which then cannot be edited or deleted, with disposition review |
A common confusion: a sensitivity label protects a document (what it is), DLP stops it leaving (where it goes), and retention controls how long it lives.
Insider risk, eDiscovery and audit
- Insider risk management uses policy templates to detect risky activity by users, such as data theft by a departing employee, while protecting privacy.
- eDiscovery searches, holds and exports content for legal or investigation purposes. The solution has a standard (core) and a premium tier.
- Audit records user and admin activity across Microsoft 365 so you can search it for investigations; premium audit retains events longer.
Example questions
Question 1. Legal counsel needs to find all email and documents about a contract dispute, preserve them and export them. Which Microsoft Purview solution should be used?
- A. Data loss prevention
- B. eDiscovery
- C. Sensitivity labels
- D. Compliance Manager
Show answer
Answer: B
eDiscovery searches, places holds on and exports content for legal cases. DLP prevents sensitive data from being shared. Sensitivity labels classify and protect individual items. Compliance Manager assesses regulatory posture and does not search content.
Want more questions like this? Full SC-900 practice tests →
Question 2. An organization must keep financial documents for seven years and then delete them automatically. Which feature meets this?
- A. A sensitivity label
- B. A data loss prevention policy
- C. The Service Trust Portal
- D. A retention label or policy
Show answer
Answer: D
A retention policy or retention label keeps content for a set period and then deletes it. Sensitivity labels classify and encrypt but do not control lifetime. DLP blocks sharing. The Service Trust Portal publishes audit reports and manages no content.
Want more questions like this? Full SC-900 practice tests →
Question 3. A manager wants to detect whether a departing employee is downloading unusual amounts of confidential files. Which solution is designed for this?
- A. Audit
- B. eDiscovery
- C. Insider risk management
- D. Records management
Show answer
Answer: C
Insider risk management uses indicators and policy templates to spot risky user activity such as data theft by departing users. Audit records activity but does not score risk. eDiscovery finds content for legal matters. Records management declares items as records.
Want more questions like this? Full SC-900 practice tests →
See also the concepts guide for the governance vocabulary and the practice test.