Content Explorer and Activity Explorer

Key features: - Summary tab: Shows the number of items per label type (sensitivity, retention) and per SIT. - Location tab: Breaks down the count by workload (SharePoint, Exchange, OneDrive). - Items tab: Lists individual items with details like location, label, SIT matches, and last modified date. - Export: You can export the list to a CSV file for offline analysis.

The tool uses the Microsoft 365 Information Protection scanner, which indexes content and applies classification. The scanning engine uses exact data match (EDM) and fingerprinting for high-accuracy detection. Content Explorer only shows items that are classified; unclassified items are not visible. This is a common exam trap: candidates think Content Explorer shows all data, but it only shows classified data.

Activity Explorer retains data for up to 30 days (for most activities) but can be extended with audit retention policies. It is updated within minutes of an activity occurring, making it near real-time. You access it via the Microsoft Purview compliance portal > Data Classification > Activity Explorer.

Key filters: - Date range: Up to 30 days by default. - Activity type: e.g., SensitivityLabelApplied, DlpRuleMatch. - Location: SharePoint, Exchange, OneDrive, Teams. - User: Specific user or group. - Label: Specific sensitivity or retention label. - Sensitive info type: Specific SIT.

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

Or in the compliance portal: Audit > Turn on auditing.

To verify that Content Explorer is working, navigate to the Data Classification page and check if the summary shows counts. If it shows zero, ensure that:

For Activity Explorer, you can verify by performing a test activity (e.g., apply a label to a document) and then checking the explorer after 15 minutes.

Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled

For Activity Explorer data, you can use Search-UnifiedAuditLog to retrieve similar data, though the explorer provides a more user-friendly interface.

In a large enterprise with over 10,000 users, Content Explorer is used monthly to audit the distribution of sensitive data. For example, a financial services company uses Content Explorer to ensure that credit card numbers (PCI-DSS) are only stored in approved SharePoint sites. The administrator exports the list of items containing credit card numbers and cross-references with site permissions. They discovered that a legacy SharePoint site had 500 documents with credit card numbers accessible to all employees. Using Content Explorer, they identified the exact documents and locations, then remediated by restricting permissions or moving the data. The 48-hour refresh was acceptable for this monthly audit.

Activity Explorer is used daily by the security operations center (SOC) to investigate DLP alerts. For instance, when a DLP policy triggers on an email containing a social security number sent externally, the SOC analyst opens Activity Explorer, filters by DlpRuleMatch activity, and sees the sender, recipient, subject, and the specific rule that fired. They can then take action, such as blocking the user or refining the policy. The near real-time nature (5-15 min latency) is sufficient for most investigations. However, during a rapid incident response, the latency can be frustrating; the SOC sometimes uses the unified audit log directly via PowerShell for faster queries.

A common misconfiguration occurs when audit logging is not enabled. In one scenario, a company deployed DLP policies but saw no activities in Activity Explorer. The administrator assumed the policies were not working and spent days troubleshooting. The root cause was that audit logging was off. After enabling it, activities appeared within 30 minutes. This highlights the importance of the prerequisite. Another issue is that Content Explorer shows zero items because sensitivity labels are not applied. The administrator must ensure that auto-labeling policies are running or that users are trained to apply labels manually. In a hybrid environment, Content Explorer does not cover on-premises file servers unless they are scanned by the Microsoft Information Protection scanner, which is a separate deployment.

Performance considerations: In tenants with millions of items, Content Explorer may time out when loading the Items tab. Microsoft recommends using filters to narrow down the scope. For example, filter by location or label to reduce the result set. Exporting to CSV is limited to 10,000 items; for larger datasets, you must use multiple exports with filters. Activity Explorer can handle high volumes but may have slower response times if the date range is too broad. Best practice is to limit queries to 7 days or less.