SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company is subject to a legal hold for an ongoing investigation. The IT administrator must prevent the deletion of any documents related to this case across SharePoint Online and OneDrive, overriding any existing deletion policies. Which Microsoft Purview capability should the administrator use?
⚠ Common exam trap
Test-takers frequently confuse Data Lifecycle Management (which manages retention and deletion policies) with the legal hold capability, not realizing that only eDiscovery (Premium) can override existing policies to preserve content for an investigation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
eDiscovery (Premium)
eDiscovery (Premium) is the correct choice because it provides legal hold capabilities that can preserve content in SharePoint Online and OneDrive for Business, overriding any deletion policies. When a legal hold is applied via eDiscovery, the system places a hold on the specified locations, preventing permanent deletion or modification of documents until the hold is released. This directly addresses the requirement to prevent deletion of case-related documents during an ongoing investigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Lifecycle Management
Why it's wrong here
Data Lifecycle Management is incorrect because it focuses on the routine management of data throughout its lifecycle, including defining retention labels and policies for data retention and deletion based on organizational or regulatory requirements. While it ensures data is kept for a specified period or deleted when no longer needed, it lacks the specific functionality to impose an immutable legal hold that overrides existing deletion policies for an ongoing investigation. It's for routine compliance, not investigative preservation.
When this WOULD be correct
A company wants to automatically retain SharePoint documents for 7 years after creation and then delete them, with no legal hold requirements. The administrator should use Data Lifecycle Management to configure retention and deletion policies.
- ✓
eDiscovery (Premium)
Why this is correct
eDiscovery (Premium) is the correct service for placing content on legal hold. It enables organizations to identify, preserve, collect, process, and review electronically stored information (ESI) for legal or investigative purposes. A key feature is the ability to apply eDiscovery holds to specific content locations, such as mailboxes and SharePoint sites, which prevents the permanent deletion of data, even if existing retention policies would otherwise dictate its removal. This ensures data integrity for ongoing investigations.
- ✗
Audit (Premium)
Why it's wrong here
Audit (Premium) is incorrect because its primary function is to provide enhanced logging and retention of audit records for user and admin activities across Microsoft 365 services. While it offers valuable insights into who did what, when, and where, it does not possess the capability to place a legal hold on content itself or prevent the deletion of documents. It records actions, but does not intervene in data lifecycle management or preservation.
- ✗
Communication Compliance
Why it's wrong here
Communication Compliance is incorrect as its purpose is to help organizations detect, investigate, and act on inappropriate messages in Microsoft Teams, Exchange Online, and Yammer. It uses machine learning to identify policy violations, such as harassment, threats, or sharing of sensitive information, within internal and external communications. This service is focused on monitoring and managing communication content for compliance, not on applying legal holds to prevent data deletion for investigations.
When this WOULD be correct
An organization wants to automatically detect and review emails or messages containing sensitive information (e.g., insider trading) and take remediation actions like notifying the sender or escalating to management.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓eDiscovery (Premium)Correct answer▾
Why this is correct
eDiscovery (Premium) is the correct service for placing content on legal hold. It enables organizations to identify, preserve, collect, process, and review electronically stored information (ESI) for legal or investigative purposes. A key feature is the ability to apply eDiscovery holds to specific content locations, such as mailboxes and SharePoint sites, which prevents the permanent deletion of data, even if existing retention policies would otherwise dictate its removal. This ensures data integrity for ongoing investigations.
✗Data Lifecycle ManagementWrong answer — click to see why▾
Why this is wrong here
Data Lifecycle Management (DLM) governs retention and deletion policies but does not provide the ability to place a legal hold that overrides existing deletion policies. For legal holds, eDiscovery (Premium) is required.
★ When this WOULD be the correct answer
A company wants to automatically retain SharePoint documents for 7 years after creation and then delete them, with no legal hold requirements. The administrator should use Data Lifecycle Management to configure retention and deletion policies.
Why candidates choose this
Candidates may confuse DLM's retention policies with legal hold capabilities, not realizing that DLM cannot override deletion policies for active legal cases.
✗Communication ComplianceWrong answer — click to see why▾
Why this is wrong here
Communication Compliance is designed to detect and manage inappropriate communications (e.g., offensive language, conflicts of interest) but does not provide the ability to place a legal hold to prevent deletion of documents across SharePoint and OneDrive.
★ When this WOULD be the correct answer
An organization wants to automatically detect and review emails or messages containing sensitive information (e.g., insider trading) and take remediation actions like notifying the sender or escalating to management.
Why candidates choose this
Candidates may confuse the 'hold' aspect of legal hold with the monitoring and policy enforcement capabilities of Communication Compliance, assuming it can also prevent deletion of content.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
eDiscovery
eDiscovery is the process of identifying, collecting, and producing electronic information for legal cases or investigations.
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.