Microsoft 365 Administrator Expert MS-102 Practice Question

Activity explorer surfaces every DLP, sensitivity label, and classifier event, including Endpoint DLP actions such as copy to removable media. It lets investigators filter by policy, sensitive information type, device, user, and a custom time range (such as the last 24 hours). The results grid can be exported to a CSV file for external analysis. The DLP alert dashboard only shows aggregated alerts and does not export raw events, Content explorer inventories at-rest content but not user actions, and Unified audit search lacks the built-in filters for sensitive information types and does not export the needed detailed CSV directly from the compliance portal.