Category: Data Security

Data Governance, Data Security, DP-800, Microsoft Certification, SQL August 1, 2026

Design and implement Dynamic Data Masking (DDM) (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Secure, optimize, and deploy database solutions (35–40%)
   --> Implement data security and compliance
      --> Design and implement Dynamic Data Masking

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

What is Dynamic Data Masking?

Dynamic Data Masking (DDM) is a SQL Server and Azure SQL feature that limits the exposure of sensitive data by masking the results returned to non-privileged users without modifying the actual data stored in the database.

Unlike encryption, DDM does not change or encrypt the stored data. Instead, SQL Server dynamically replaces sensitive values with masked values when queries are executed by users who do not have permission to view the original data.

For example, the database may contain:

CustomerName	SSN	Email
John Smith	123-45-6789	john@email.com

A privileged user sees:

CustomerName	SSN	Email
John Smith	123-45-6789	john@email.com

A non-privileged user may see:

CustomerName	SSN	Email
John Smith	XXX-XX-6789	jXXX@XXXX.com

The underlying data never changes.

Why Use Dynamic Data Masking?

Organizations frequently store sensitive information such as:

Personally Identifiable Information (PII)
Social Security Numbers
Credit card numbers
Email addresses
Phone numbers
Employee salaries
Medical information

Not every user who queries the database should have unrestricted access to these values.

DDM allows developers to:

Reduce accidental data exposure
Protect sensitive fields
Simplify application development
Support compliance initiatives
Allow customer support personnel to work with realistic-looking data

How Dynamic Data Masking Works

When a user executes a query:

SQL Server checks whether the user has permission to view unmasked data.
If the user has the UNMASK permission, actual values are returned.
Otherwise, SQL Server substitutes masked values before sending the results.

The database itself remains unchanged.

Dynamic Data Masking Architecture

			
Database
│
├── Actual Data
│      987-65-4321
│
├── User A
│      Has UNMASK permission
│
│      Result:
│      987-65-4321
│
└── User B
       No UNMASK permission
       Result:
       XXX-XX-4321

		

Benefits of Dynamic Data Masking

DDM provides several important advantages.

Easy to Implement

Masking is configured using T-SQL without requiring application changes.

No Data Duplication

The original data remains stored only once.

Transparent to Applications

Applications continue issuing the same queries.

No application code changes are required.

Supports Least Privilege

Users receive only the information they need.

Helps Meet Compliance Requirements

Although DDM is not encryption, it helps organizations reduce unnecessary exposure of sensitive information.

Dynamic Data Masking vs Encryption

Dynamic Data Masking	Encryption
Masks query results	Encrypts stored data
Data remains unchanged	Data stored encrypted
Protects against accidental viewing	Protects against data theft
Transparent to applications	May require encryption keys
Does not secure backups	Protects stored data

Microsoft expects candidates to understand that DDM is not a replacement for encryption technologies such as Always Encrypted or Transparent Data Encryption (TDE).

Supported Masking Functions

SQL Server supports several built-in masking functions.

Default Mask

Masks data according to its data type.

Example:

Original:

John Smith

Masked:

XXXX

Syntax:

MASKED WITH (FUNCTION = 'default()')

Email Mask

Designed specifically for email addresses.

Original:

john.smith@email.com

Masked:

jXXX@XXXX.com

Syntax:

MASKED WITH (FUNCTION = 'email()')

Partial Mask

Reveals part of a string while masking the remainder.

Example:

Original:

555-123-4567

Masked:

XXX-XXX-4567

Syntax:

			
MASKED WITH
(
FUNCTION='partial(prefix,padding,suffix)'
)

Example:

			
MASKED WITH
(
FUNCTION='partial(0,"XXX-XXX-",4)'
)

Random Mask

Returns a random value within a specified numeric range.

Example:

Original Salary

Masked

Syntax

			
MASKED WITH
(
FUNCTION='random(1,100000)'
)

Useful when exact values should never be exposed.

Creating a Masked Column

Example:

			
CREATE TABLE Customers
(
    CustomerID INT,
    Name NVARCHAR(100),
    Email NVARCHAR(200)
    MASKED WITH (FUNCTION='email()'),
    SSN CHAR(11)
    MASKED WITH
    (
        FUNCTION='partial(0,"XXX-XX-",4)'
    )
);

		

Adding a Mask to an Existing Column

			
ALTER TABLE Customers
ALTER COLUMN Email
ADD MASKED
WITH (FUNCTION='email()');

Removing a Mask

			
ALTER TABLE Customers
ALTER COLUMN Email
DROP MASKED;

Granting UNMASK Permission

Privileged users may view actual values.

GRANT UNMASK TO HRManager;

Revoking Permission

REVOKE UNMASK FROM HRManager;

Viewing Mask Definitions

View masking metadata.

			
SELECT *
FROM sys.masked_columns;

Useful during administration and auditing.

DDM with Azure SQL Database

Dynamic Data Masking is fully supported in:

Azure SQL Database
Azure SQL Managed Instance
SQL Server

Azure SQL also provides portal-based configuration through the Azure Portal.

Developers can create masks without writing T-SQL.

Limitations of Dynamic Data Masking

Candidates should understand these limitations.

It Is Not Encryption

Anyone with sufficient permissions can retrieve actual values.

Database Administrators Can View Data

Members of powerful administrative roles can bypass masking.

Cannot Stop Inference Attacks

Users may infer values through repeated queries.

Not Intended for High-Security Scenarios

Highly confidential data should use:

Always Encrypted
Transparent Data Encryption
Row-Level Security
Proper access control

Expressions Return Masked Values

If a masked column is used in expressions, the expression also returns masked results for users without UNMASK permission.

Best Practices

Mask Only Sensitive Columns

Avoid unnecessary masking.

Combine with Other Security Features

Use together with:

Always Encrypted
Row-Level Security
Transparent Data Encryption
Microsoft Entra authentication
Least privilege access

Grant UNMASK Sparingly

Only trusted users should receive this permission.

Test Using Non-Privileged Accounts

Always verify what ordinary users actually see.

Audit Sensitive Access

Monitor who receives UNMASK permissions.

Dynamic Data Masking vs Row-Level Security

Dynamic Data Masking	Row-Level Security
Masks values	Filters rows
User sees all rows	User sees only authorized rows
Protects columns	Protects records
Works with SELECT results	Controls data visibility
Often used with RLS	Often combined with DDM

DP-800 Exam Tips

Candidates should be able to:

Explain what Dynamic Data Masking is.
Differentiate masking from encryption.
Identify supported masking functions.
Create masked columns using CREATE TABLE and ALTER TABLE.
Grant and revoke the UNMASK permission.
Understand when DDM is appropriate.
Recognize DDM limitations.
Choose DDM versus Always Encrypted, TDE, or Row-Level Security based on the security requirement.
Understand that DDM protects against accidental exposure, not malicious users with elevated privileges.

Practice Exam Questions

Question 1

A company wants customer support representatives to view only partially masked Social Security numbers while allowing HR staff to view the full values.

Which SQL Server feature best meets this requirement?

A. Transparent Data Encryption

B. Dynamic Data Masking

C. Always Encrypted

D. Data Compression

Answer: B

Explanation: Dynamic Data Masking displays masked values to unauthorized users while allowing authorized users with the appropriate permissions to see the original data.

Question 2

Which statement about Dynamic Data Masking is true?

A. It encrypts data stored on disk.

B. It permanently changes stored values.

C. It masks query results for users without UNMASK permission.

D. It replaces encryption.

Answer: C

Explanation: Dynamic Data Masking only alters the data presented in query results. The stored values remain unchanged.

Question 3

Which masking function is specifically designed for email addresses?

A. partial()

B. random()

C. default()

D. email()

Answer: D

Explanation: The email() masking function preserves the general format of an email address while obscuring most of the information.

Question 4

Which statement best describes the partial() masking function?

A. It encrypts selected characters.

B. It returns random values.

C. It permanently replaces data.

D. It reveals specified prefix and suffix characters while masking the middle.

Answer: D

Explanation: The partial() function exposes configurable leading and trailing characters while masking the remaining portion of the value.

Question 5

Which permission allows a user to view unmasked data?

A. SELECT

B. CONTROL

C. UNMASK

D. VIEW DEFINITION

Answer: C

Explanation: Users granted the UNMASK permission can view the original values instead of the masked representations.

Question 6

Which system catalog view displays information about masked columns?

A. sys.columns

B. sys.masked_columns

C. sys.tables

D. sys.database_permissions

Answer: B

Explanation: The sys.masked_columns catalog view contains metadata about all columns configured with Dynamic Data Masking.

Question 7

A database administrator wants to protect highly confidential financial information from administrators who manage the database server.

Which technology should be preferred over Dynamic Data Masking?

A. Always Encrypted

B. Dynamic Data Masking

C. Partial masking

D. Random masking

Answer: A

Explanation: Always Encrypted ensures that sensitive data remains encrypted even from database administrators because encryption and decryption occur on the client side.

Question 8

Which statement about Dynamic Data Masking and application code is generally correct?

A. Applications must always be rewritten.

B. DDM requires client-side decryption.

C. Existing queries usually continue to work without modification.

D. Applications cannot access masked tables.

Answer: C

Explanation: Dynamic Data Masking is transparent to most applications, allowing existing queries to function normally while returning masked data when appropriate.

Question 9

A developer executes the following statement:

GRANT UNMASK TO SalesManager;

What is the effect?

A. The SalesManager can modify masked columns.

B. The SalesManager can bypass row-level security.

C. The SalesManager can view original values in masked columns, provided they also have permission to access the data.

D. All users inherit the UNMASK permission.

Answer: C

Explanation: The UNMASK permission allows a user to see unmasked values but does not grant access to data that the user is otherwise unauthorized to read.

Question 10

Which security strategy provides the strongest protection for sensitive database columns?

A. Use only Dynamic Data Masking.

B. Use only Row-Level Security.

C. Use only Transparent Data Encryption.

D. Combine Dynamic Data Masking with encryption, least-privilege access, and other SQL Server security features.

Answer: D

Explanation: Dynamic Data Masking is most effective as part of a layered security strategy that also includes encryption, access controls, auditing, and other SQL Server security features.

Go to the DP-800 Exam Prep Hub main page

Data Governance, Data Security, DP-800, Microsoft Certification August 1, 2026

Design and implement data encryption, including Always Encrypted and column-level encryption (DP-800 Exam Prep)

This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Secure, optimize, and deploy database solutions (35–40%)
   --> Implement data security and compliance
      --> Design and implement data encryption, including Always Encrypted and column-level encryption

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Data encryption is one of the most important security capabilities available in Microsoft SQL Server, Azure SQL Database, Azure SQL Managed Instance, and Microsoft Fabric SQL Database. Encryption helps protect sensitive information such as personally identifiable information (PII), financial records, healthcare data, passwords, and confidential business information from unauthorized access.

For the DP-800: Developing AI-Enabled Database Solutions exam, you should understand not only how to implement encryption, but also when to use different encryption technologies, their limitations, performance implications, and how they interact with applications.

Why Data Encryption Matters

Modern organizations must comply with regulations such as:

GDPR
HIPAA
PCI-DSS
SOC 2
ISO 27001

Encryption protects data against:

Database theft
Unauthorized administrators
Lost backups
Insider threats
Network interception

SQL Server provides multiple encryption technologies, each solving a different security problem.

SQL Server Encryption Technologies

Understanding which technology solves which problem is critical for the exam.

Technology	Protects	Data State
Transparent Data Encryption (TDE)	Database files and backups	At rest
Always Encrypted	Sensitive columns from DBAs and attackers	In use and at rest
Column-Level Encryption	Individual columns	At rest
TLS/SSL	Network traffic	In transit
Dynamic Data Masking	Prevents accidental viewing	Query results
Row-Level Security	Limits rows returned	Query execution

Data at Rest vs Data in Transit vs Data in Use

A common exam objective is understanding these three states.

Data at Rest

Data stored on:

MDF files
LDF files
Backups
Storage disks

Protected using:

TDE
Column encryption
Always Encrypted

Data in Transit

Data traveling:

Client → SQL Server
SQL Server → Application

Protected using:

TLS (SSL)

Data in Use

Data currently being processed inside memory.

Only Always Encrypted protects sensitive data while SQL Server is processing queries.

Transparent Data Encryption (TDE)

Although the objective focuses on Always Encrypted and column-level encryption, you should understand how TDE differs.

TDE encrypts:

Database files
Log files
Backups

Advantages:

No application changes
Easy to enable
Minimal performance overhead

Limitations:

SQL Server decrypts data automatically.
Database administrators can still read data.

TDE protects storage—not the data itself from privileged users.

Column-Level Encryption

Column-level encryption encrypts specific columns inside a table.

Example:

			
CreditCardNumber
SocialSecurityNumber
Salary

Instead of encrypting the whole database, only selected columns are encrypted.

How Column-Level Encryption Works

SQL Server uses encryption functions such as:

ENCRYPTBYKEY
DECRYPTBYKEY
ENCRYPTBYPASSPHRASE
DECRYPTBYPASSPHRASE

Example:

			
OPEN SYMMETRIC KEY CustomerKey
DECRYPTION BY CERTIFICATE CustomerCert;
UPDATE Customers
SET SSN =
ENCRYPTBYKEY(KEY_GUID('CustomerKey'), '123-45-6789');

		

Reading data:

			
SELECT
CONVERT(varchar,
DECRYPTBYKEY(SSN))
FROM Customers;

Encryption Hierarchy

SQL Server uses multiple encryption layers.

			
Service Master Key
        ↓
Database Master Key
        ↓
Certificate
        ↓
Symmetric Key
        ↓
Encrypted Column

		

Each level protects the one below it.

Symmetric Encryption

Uses one key for both:

Encryption
Decryption

Advantages

Fast
Efficient
Best for large datasets

Example

			
Encrypt → Key A
Decrypt → Key A

Asymmetric Encryption

Uses:

Public key
Private key

Advantages

Strong security
Digital signatures

Disadvantages

Slower

Usually used to protect symmetric keys.

Certificates

Certificates often protect symmetric keys.

Example:

			
Certificate
↓
Protects Symmetric Key
↓
Encrypts Customer Data

		

Always Encrypted

Always Encrypted is one of the most important DP-800 topics.

Unlike traditional encryption:

SQL Server never sees the plaintext values.

Encryption occurs inside the client application.

Why Always Encrypted Exists

Imagine a database administrator with full access.

With normal encryption:

DBA can decrypt data.

With Always Encrypted:

DBA cannot read encrypted values.

Only authorized client applications possess the encryption keys.

How Always Encrypted Works

			
Application
↓
Encrypt value
↓
SQL Server stores ciphertext
↓
Application retrieves ciphertext
↓
Application decrypts

		

SQL Server never performs decryption.

Benefits

Protects against:

Curious administrators
Database theft
Backup theft
Cloud administrators
Insider attacks

Key Components

Always Encrypted uses two key types.

Column Master Key (CMK)

Stored outside SQL Server.

Examples:

Windows Certificate Store
Azure Key Vault
Hardware Security Module (HSM)

Purpose:

Protects Column Encryption Keys.

Column Encryption Key (CEK)

Stored inside SQL Server.

Purpose:

Encrypts actual column values.

Hierarchy:

			
CMK
↓
CEK
↓
Encrypted Data

		

Deterministic Encryption

Always produces the same ciphertext for identical values.

Example

			
"Florida"
↓
A91BCD
"Florida"
↓
A91BCD

		

Advantages

Supports:

Equality searches
Joins
GROUP BY
Indexes

Disadvantages

Repeated values are recognizable.

Randomized Encryption

Produces different ciphertext every time.

Example

			
Florida
↓
A91BCD
Florida
↓
XYZ123

		

Advantages

Maximum security.

Disadvantages

Cannot perform:

Equality comparisons
JOIN
GROUP BY
Index lookups

Deterministic vs Randomized

Feature	Deterministic	Randomized
Highest security	No	Yes
Equality search	Yes	No
JOIN	Yes	No
GROUP BY	Yes	No
Index seek	Yes	No

Creating a Column Master Key

Example:

			
CREATE COLUMN MASTER KEY CMK1
WITH
(
KEY_STORE_PROVIDER_NAME =
'MSSQL_CERTIFICATE_STORE',
KEY_PATH =
'CurrentUser/My/123456789'
);

		

Creating a Column Encryption Key

			
CREATE COLUMN ENCRYPTION KEY CEK1
WITH VALUES
(
COLUMN_MASTER_KEY = CMK1,
ALGORITHM = 'RSA_OAEP',
ENCRYPTED_VALUE = ...
);

		

Encrypting a Column

			
CREATE TABLE Customers
(
CustomerID INT,
SSN CHAR(11)
COLLATE Latin1_General_BIN2
ENCRYPTED WITH
(
COLUMN_ENCRYPTION_KEY = CEK1,
ENCRYPTION_TYPE = DETERMINISTIC,
ALGORITHM =
'AEAD_AES_256_CBC_HMAC_SHA_256'
)
);

		

Secure Enclaves

Always Encrypted originally limited many SQL operations.

Secure Enclaves improve functionality by allowing protected computations within a secure hardware-based memory region.

Benefits:

Richer comparisons
Pattern matching
Range queries
In-place encryption
Better performance

Limitations of Always Encrypted

Developers should understand these limitations.

Not all SQL operations are supported.

Some restrictions include:

LIKE (without enclaves)
Pattern matching
Sorting randomized columns
Range comparisons
Certain aggregates
Some conversions

Client Driver Requirements

Always Encrypted requires supported drivers.

Examples:

Microsoft.Data.SqlClient
.NET Framework
ODBC Driver
JDBC Driver

Client drivers perform:

Encryption
Decryption
Key retrieval

Azure Key Vault Integration

A common enterprise deployment stores Column Master Keys inside Azure Key Vault.

Benefits:

Centralized key management
Hardware-backed security
Automatic auditing
Key rotation
Separation of duties

Performance Considerations

Always Encrypted introduces overhead because:

Client encrypts data
Client decrypts data
Keys must be managed
Network payloads increase

However, it provides much stronger protection than standard encryption.

Best Practices

Microsoft recommends:

Encrypt only sensitive columns.
Store CMKs outside SQL Server.
Use Azure Key Vault when possible.
Use deterministic encryption only when querying is required.
Use randomized encryption for maximum confidentiality.
Rotate encryption keys regularly.
Use TLS together with Always Encrypted.
Monitor application performance after enabling encryption.
Test query compatibility before production deployment.

DP-800 Exam Tips

Be prepared to distinguish:

TDE vs Always Encrypted
Column-Level Encryption vs Always Encrypted
Deterministic vs Randomized encryption
CMK vs CEK
Encryption at rest vs in transit vs in use
Azure Key Vault integration
Secure Enclaves
Encryption hierarchy
Performance implications
Client-side versus server-side encryption

Practice Exam Questions

Question 1

A company wants to ensure that database administrators cannot view customers’ Social Security numbers while still allowing applications to access the data. Which encryption technology should be implemented?

A. Transparent Data Encryption (TDE)

B. Dynamic Data Masking

C. Row-Level Security

D. Always Encrypted

Answer: D

Explanation: Always Encrypted performs encryption and decryption on the client side, preventing SQL Server and database administrators from viewing plaintext data.

Question 2

Which key encrypts the actual column data in Always Encrypted?

A. Column Encryption Key

B. Database Master Key

C. Service Master Key

D. Column Master Key

Answer: A

Explanation: The Column Encryption Key (CEK) encrypts the column values. The Column Master Key (CMK) protects the CEK.

Question 3

Which encryption type should you choose if users must frequently search by exact Social Security number?

A. Randomized encryption

B. Transparent Data Encryption

C. Deterministic encryption

D. Dynamic Data Masking

Answer: C

Explanation: Deterministic encryption produces the same ciphertext for identical values, enabling equality searches and index usage.

Question 4

Which SQL Server feature encrypts entire database files and backup files without requiring application changes?

A. Always Encrypted

B. Column-Level Encryption

C. Dynamic Data Masking

D. Transparent Data Encryption

Answer: D

Explanation: Transparent Data Encryption (TDE) encrypts database and backup files, protecting data at rest.

Question 5

Where is the Column Master Key typically stored?

A. Azure Storage Account

B. SQL Server system database

C. TempDB

D. Azure Key Vault or Windows Certificate Store

Answer: D

Explanation: Microsoft recommends storing Column Master Keys outside SQL Server, commonly in Azure Key Vault or the Windows Certificate Store.

Question 6

Which encryption method provides the highest confidentiality for sensitive columns?

A. Deterministic encryption

B. Randomized encryption

C. Transparent Data Encryption

D. TLS encryption

Answer: B

Explanation: Randomized encryption produces different ciphertext for identical values, making frequency analysis much more difficult.

Question 7

A developer wants to encrypt only the CreditCardNumber column while leaving the remainder of the table unchanged. Which approach is most appropriate?

A. Column-Level Encryption

B. Transparent Data Encryption

C. Database snapshots

D. Always On Availability Groups

Answer: A

Explanation: Column-level encryption targets individual columns rather than the entire database.

Question 8

Which SQL Server feature enhances Always Encrypted by allowing additional query operations on encrypted columns?

A. Secure Enclaves

B. Dynamic Data Masking

C. PolyBase

D. Stretch Database

Answer: A

Explanation: Secure Enclaves enable richer computations on encrypted data, including some range and pattern-matching operations.

Question 9

Which data state is protected by TLS encryption?

A. Data at rest

B. Data in transit

C. Data in use

D. Archived data

Answer: B

Explanation: TLS encrypts network communications between clients and SQL Server, protecting data while it is being transmitted.

Question 10

Why is Always Encrypted considered more secure than traditional column-level encryption?

A. It automatically compresses encrypted data.

B. It encrypts entire databases.

C. SQL Server never has access to plaintext values because encryption occurs on the client side.

D. It eliminates the need for encryption keys.

Answer: C

Explanation: Always Encrypted keeps encryption keys and plaintext data outside SQL Server, ensuring that even highly privileged users cannot view sensitive information.

Go to the DP-800 Exam Prep Hub main page

AB-900, AI Governance, AI Security, Data Governance, Data Security, Microsoft Certification June 27, 2026

Understand features and capabilities of SharePoint Advanced Management, including restricted site access (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify and monitor oversharing in SharePoint in Microsoft 365
      --> Understand features and capabilities of SharePoint Advanced Management, including restricted site access

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

As organizations increasingly rely on Microsoft 365, SharePoint Online, Microsoft Teams, and Microsoft 365 Copilot, protecting organizational data has become more important than ever. While collaboration is essential, unrestricted sharing can expose confidential information to unintended users.

To help organizations better govern SharePoint content, Microsoft offers SharePoint Advanced Management (SAM), a collection of advanced governance, reporting, security, and lifecycle management capabilities designed to improve the security of SharePoint and OneDrive environments.

One of its most important features is Restricted Site Access, which allows administrators to temporarily limit access to specific SharePoint sites that may contain highly sensitive or potentially overshared information.

For the AB-900 exam, you should understand the purpose of SharePoint Advanced Management, its major capabilities, and how Restricted Site Access helps reduce data exposure.

What is SharePoint Advanced Management?

SharePoint Advanced Management is a set of administrative capabilities that extends the standard SharePoint Online administration experience.

Its goals include:

Improving governance
Reducing oversharing
Enhancing visibility into permissions
Strengthening data protection
Supporting Microsoft 365 Copilot readiness
Helping organizations adopt Zero Trust security principles

Rather than replacing Microsoft Purview or Microsoft Defender, SharePoint Advanced Management complements these services by focusing specifically on SharePoint and OneDrive administration.

Why SharePoint Advanced Management Is Important

Organizations often have:

Thousands of SharePoint sites
Millions of documents
Numerous external users
Complex permission structures
Years of accumulated sharing links

As these environments grow, administrators face challenges such as:

Overshared files
Forgotten external sharing
Stale permissions
Sensitive documents accessible by too many users
Inactive or abandoned sites

SharePoint Advanced Management provides tools to identify and address these issues before they become security incidents.

Key Capabilities of SharePoint Advanced Management

SharePoint Advanced Management includes several capabilities designed to improve governance.

1. Data Access Governance Reporting

Administrators can:

Identify overshared sites
Review sharing activity
Analyze permission configurations
Discover external access
Locate high-risk collaboration sites

These reports provide visibility into who can access organizational content.

2. Site Lifecycle Management

Organizations frequently create project sites that remain active long after projects end.

SharePoint Advanced Management helps administrators:

Identify inactive sites
Review site ownership
Archive or delete unused sites
Reduce unnecessary content exposure

Proper lifecycle management reduces security risks while improving overall governance.

3. Oversharing Insights

Administrators can identify:

Sites shared broadly
Anonymous sharing links
Guest access
Sensitive sites with excessive permissions
Large-scale permission inheritance issues

These insights are particularly valuable before deploying Microsoft 365 Copilot.

4. Site Ownership Management

SharePoint sites require responsible owners.

Advanced Management helps administrators identify:

Sites without owners
Inactive owners
Ownership inconsistencies

Proper ownership improves accountability and ensures permissions are reviewed regularly.

5. Sharing Governance

Administrators can evaluate:

External sharing
Anonymous links
Organization-wide access
Sharing policies
Guest permissions

This helps organizations reduce unnecessary collaboration risks.

6. Restricted Site Access

One of the most important SharePoint Advanced Management capabilities is Restricted Site Access.

What is Restricted Site Access?

Restricted Site Access allows administrators to temporarily limit access to a SharePoint site.

When enabled:

Most users lose access to the site.
Only designated administrators or approved users can access the content.
Copilot and Microsoft Search continue to respect the updated permissions because they always honor Microsoft 365 security trimming.

This feature is useful when a site contains highly sensitive information or requires investigation.

Why Use Restricted Site Access?

Organizations may need to immediately reduce access when:

Sensitive information has been overshared.
A security investigation is underway.
Legal or regulatory reviews are occurring.
Confidential merger or acquisition documents are stored.
Human Resources investigations are active.
Executive leadership documents require additional protection.
Sensitive intellectual property is being reviewed.

Rather than deleting the site, administrators can quickly restrict access while remediation occurs.

How Restricted Site Access Works

The feature temporarily changes access behavior by allowing only explicitly authorized users to access the site.

Typical workflow:

Administrator identifies a high-risk site.
Restricted Site Access is enabled.
Only approved users retain access.
Administrators investigate permissions.
Oversharing issues are corrected.
Normal access is restored when appropriate.

Benefits of Restricted Site Access

Organizations gain several advantages:

Rapid Risk Reduction

Potential data exposure is reduced immediately.

Supports Investigations

Investigators can examine permissions without widespread user access.

Improves Governance

Administrators gain time to review sharing settings before reopening access.

Protects Sensitive Information

Highly confidential documents remain accessible only to authorized personnel.

Supports Compliance

Temporary restrictions can assist with legal, regulatory, or internal compliance reviews.

Relationship with Microsoft 365 Copilot

Microsoft 365 Copilot respects Microsoft 365 permissions.

If a site becomes restricted:

Copilot cannot retrieve information from that site for users who no longer have permission.
Microsoft Search also honors the updated permissions.
Other Microsoft 365 services continue using the same security model.

Restricted Site Access therefore reduces the likelihood that Copilot will surface sensitive content from that site.

Relationship with Microsoft Purview

SharePoint Advanced Management and Microsoft Purview work together.

Microsoft Purview focuses on:

Data classification
Sensitivity labels
Data Loss Prevention (DLP)
Insider Risk Management
Data Lifecycle Management
Compliance

SharePoint Advanced Management focuses on:

Site governance
Permissions
Oversharing
Site administration
Access analysis
Restricted Site Access

Together they provide comprehensive protection for Microsoft 365 data.

Relationship with Microsoft Defender

Microsoft Defender identifies threats such as:

Compromised accounts
Suspicious user activity
Malware
Phishing attacks

If Defender identifies suspicious activity involving a SharePoint site, administrators may choose to enable Restricted Site Access while investigating the incident.

Best Practices

Microsoft recommends the following practices:

Regularly review Data Access Governance reports.
Minimize broad “Everyone” permissions.
Review external sharing frequently.
Assign active site owners.
Archive inactive sites.
Apply sensitivity labels to sensitive content.
Use Restricted Site Access only when necessary.
Review restricted sites periodically and restore normal access when appropriate.
Combine SharePoint Advanced Management with Microsoft Purview and Microsoft Defender for layered protection.
Follow the principle of least privilege.

Exam Tips

Remember these key points for the AB-900 exam:

SharePoint Advanced Management focuses on governance and security for SharePoint and OneDrive.
It helps identify and remediate oversharing.
Restricted Site Access temporarily limits access to sensitive SharePoint sites.
Copilot always respects SharePoint permissions, including restricted sites.
Restricted Site Access is useful during investigations or when sensitive information has been overshared.
SharePoint Advanced Management complements Microsoft Purview rather than replacing it.
Proper site ownership and lifecycle management reduce long-term security risks.

Practice Exam Questions

Question 1

Which primary problem does SharePoint Advanced Management help organizations address?

A. Windows operating system updates

B. Oversharing and governance of SharePoint content

C. SQL Server performance tuning

D. Microsoft Teams meeting scheduling

Correct Answer: B

Explanation: SharePoint Advanced Management provides governance tools that help identify oversharing, manage permissions, and improve the security of SharePoint and OneDrive environments.

Question 2

What is the purpose of Restricted Site Access?

A. Permanently delete SharePoint sites

B. Encrypt every document within a site

C. Temporarily limit access to a SharePoint site for authorized users only

D. Automatically archive inactive sites

Correct Answer: C

Explanation: Restricted Site Access allows administrators to temporarily restrict access to a site while investigating or protecting sensitive information.

Question 3

Why is SharePoint Advanced Management valuable before deploying Microsoft 365 Copilot?

A. It increases Copilot response speed.

B. It upgrades Microsoft Graph.

C. It removes all external users automatically.

D. It helps identify overshared content that Copilot could otherwise access based on existing permissions.

Correct Answer: D

Explanation: Since Copilot honors existing permissions, reducing oversharing before deployment helps minimize the risk of exposing sensitive information.

Question 4

Which capability is included in SharePoint Advanced Management?

A. Azure virtual machine backup

B. Microsoft Intune device enrollment

C. Data Access Governance reporting

D. Windows Server patch management

Correct Answer: C

Explanation: Data Access Governance reporting is a core capability that helps administrators analyze permissions and identify overshared content.

Question 5

What happens when Restricted Site Access is enabled?

A. Microsoft 365 Copilot ignores the restriction.

B. Only approved users and administrators retain access to the site.

C. All SharePoint sites become read-only.

D. External sharing is permanently disabled across the tenant.

Correct Answer: B

Explanation: Restricted Site Access limits access to authorized users, and Copilot continues to respect those permissions.

Question 6

Which Microsoft service primarily complements SharePoint Advanced Management by classifying and protecting sensitive information?

A. Microsoft Purview

B. Microsoft Paint

C. Windows Defender Firewall

D. Microsoft Project

Correct Answer: A

Explanation: Microsoft Purview provides data classification, labeling, DLP, and compliance capabilities that complement SharePoint governance features.

Question 7

Which scenario is an appropriate use case for Restricted Site Access?

A. Scheduling recurring Teams meetings

B. Updating Microsoft 365 licenses

C. Protecting a SharePoint site containing confidential merger documents during negotiations

D. Increasing SharePoint storage capacity

Correct Answer: C

Explanation: Restricting access to highly confidential content during sensitive business activities helps reduce the risk of accidental exposure.

Question 8

Which governance activity helps reduce long-term security risks in SharePoint?

A. Creating additional anonymous sharing links

B. Allowing all users full control of every site

C. Disabling Microsoft Search

D. Reviewing inactive sites and assigning active site owners

Correct Answer: D

Explanation: Proper site ownership and lifecycle management reduce abandoned sites and improve ongoing governance.

Question 9

How does Microsoft 365 Copilot interact with a site that has Restricted Site Access enabled?

A. Copilot bypasses the restriction for administrators only.

B. Copilot ignores SharePoint permissions.

C. Copilot respects the updated permissions and cannot retrieve content for unauthorized users.

D. Copilot copies restricted files into Microsoft Graph.

Correct Answer: C

Explanation: Copilot always honors Microsoft 365 permissions. If a user cannot access a restricted site, Copilot cannot use its content in responses for that user.

Question 10

Which statement best describes SharePoint Advanced Management?

A. It replaces Microsoft Purview entirely.

B. It is focused on SharePoint and OneDrive governance, permissions, lifecycle management, and oversharing protection.

C. It functions as an antivirus solution.

D. It manages Microsoft Entra ID authentication policies.

Correct Answer: B

Explanation: SharePoint Advanced Management provides advanced governance capabilities for SharePoint and OneDrive, including oversharing detection, site lifecycle management, permission analysis, and Restricted Site Access.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI, AI Governance, AI Security, Data Security, Microsoft Certification June 27, 2026

Discover and Manage AI activity by using DSPM for AI (Part 1) (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify data protection and governance risks for Microsoft 365 and Copilot
      --> Discover and Manage AI activity by using DSPM for AI

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

As organizations increasingly adopt AI-powered tools such as Microsoft 365 Copilot, administrators face a new challenge: understanding how AI accesses, processes, and exposes organizational data. Traditional security tools focus on protecting users, devices, and data, but AI introduces new considerations. AI assistants can summarize documents, answer questions, generate reports, and analyze data from across an organization’s Microsoft 365 environment. If permissions are overly broad or sensitive information is poorly governed, AI can unintentionally surface information to users who already have access but should not necessarily see it in a summarized or easily discoverable form.

To address these challenges, Microsoft introduced Microsoft Purview Data Security Posture Management (DSPM) for AI, a solution designed to help organizations discover AI usage, identify potential security risks, understand data exposure, and strengthen governance before and during AI adoption.

For the AB-900 exam, you are not expected to configure DSPM for AI. Instead, you should understand:

What DSPM for AI is
Why organizations use it
How it discovers AI activity
How it helps identify risks
How it integrates with Microsoft Purview
The types of recommendations it provides

What Is Microsoft Purview DSPM for AI?

Microsoft Purview DSPM for AI is a governance and security solution that provides visibility into how artificial intelligence applications interact with organizational data.

Rather than preventing AI usage, DSPM for AI helps administrators answer important questions such as:

Which AI applications are employees using?
What sensitive information is being accessed?
Are AI tools exposing confidential content?
Are permissions overly broad?
Are Microsoft 365 Copilot users accessing highly sensitive data?
Where should security controls be strengthened?

Think of DSPM for AI as a risk discovery and governance solution specifically designed for AI workloads.

What Does “Data Security Posture Management” Mean?

The term Data Security Posture Management (DSPM) refers to continuously evaluating an organization’s data environment to identify security weaknesses before they become incidents.

DSPM focuses on questions such as:

Where is sensitive data stored?
Who has access?
Is the data properly classified?
Are security policies protecting it?
Could AI expose it more easily?

When AI is introduced, DSPM expands these questions to include:

Which AI tools are interacting with company data?
Which users are using AI?
What content is AI accessing?
Could AI reveal confidential information?
Are there oversharing risks?

Rather than reacting after a breach occurs, DSPM promotes proactive risk management.

Why Organizations Need DSPM for AI

Many organizations begin using AI before fully understanding their existing data environment.

Common issues include:

Excessive file permissions
Sensitive documents shared too broadly
Unlabeled confidential data
Legacy SharePoint permissions
Public Teams channels
Old collaboration sites
Inactive security policies

Without visibility into these issues, AI may legally retrieve information based on existing permissions—even though administrators were unaware those permissions existed.

DSPM for AI helps organizations discover these weaknesses before they become security problems.

Core Capabilities of DSPM for AI

Microsoft Purview DSPM for AI provides several major capabilities.

1. Discover AI Usage

DSPM identifies where AI is being used throughout the organization.

Examples include:

Microsoft 365 Copilot
Microsoft Copilot Chat
AI-enabled Microsoft services
Supported third-party AI applications

Administrators gain visibility into:

AI adoption
AI usage trends
Departments using AI
Types of AI interactions

This helps organizations understand how quickly AI is being adopted.

2. Discover Sensitive Data Exposure

DSPM evaluates whether AI has access to sensitive organizational data.

Examples include:

Financial reports
HR records
Customer information
Legal documents
Intellectual property
Healthcare information
Personally identifiable information (PII)

The solution identifies locations where sensitive information may be accessible through AI.

3. Identify Oversharing Risks

One of the most important concepts for the AB-900 exam is oversharing.

Oversharing occurs when users have legitimate permissions to data that administrators did not intend them to have.

For example:

A confidential SharePoint library inherits incorrect permissions.
Hundreds of employees can read executive documents.
Microsoft 365 Copilot can summarize those documents for anyone with existing access.

The problem is not Copilot.

The problem is the underlying permissions.

DSPM helps identify these situations.

4. Inventory AI Applications

Organizations often have many AI applications in use.

DSPM helps administrators discover:

Approved AI tools
Newly adopted AI tools
Shadow AI applications
AI usage across departments

This visibility supports governance decisions.

5. Monitor AI Interactions

DSPM can provide insights into how AI interacts with organizational content.

Examples include:

Documents accessed
Sensitive data locations
AI usage frequency
Common AI workflows
Business units using AI

Administrators gain a better understanding of AI usage patterns without reading users’ private prompts or monitoring employee productivity.

How DSPM for AI Discovers AI Activity

DSPM analyzes signals across Microsoft 365 services to understand AI usage.

These signals may include:

User activity
Data access
File classifications
Permissions
Labels
Microsoft Graph relationships
Microsoft Purview metadata

Rather than simply counting AI prompts, DSPM builds a broader picture of how AI interacts with organizational data.

Microsoft Graph’s Role

One important concept for the AB-900 exam is understanding the relationship between Microsoft Graph and DSPM.

Microsoft Graph acts as the intelligence layer connecting Microsoft 365 services.

DSPM uses Microsoft Graph signals to understand:

Which files users can access
Collaboration relationships
SharePoint permissions
Teams memberships
OneDrive access
Email relationships
Microsoft 365 activity

This allows DSPM to identify situations where AI could expose sensitive information because users already possess excessive permissions.

Data Sources Evaluated by DSPM

DSPM evaluates multiple Microsoft 365 services.

Examples include:

SharePoint Online

Sensitive document libraries
Overshared sites
Confidential folders
File permissions

OneDrive

Shared personal files
External sharing
Sensitive documents
Personal work data

Microsoft Teams

Shared files
Team memberships
Collaboration spaces
Shared conversations

Exchange Online

Email data
Mailbox access
Shared mailboxes
Sensitive communications

Microsoft 365 Copilot

DSPM evaluates how Copilot interacts with organizational data by examining:

Available permissions
Data sources
Sensitive information exposure
Governance controls

Types of Risks DSPM Can Identify

DSPM helps identify a variety of AI-related risks.

Overshared Content

Examples include:

Everyone can access HR documents.
Finance reports are visible to the entire company.
Sensitive SharePoint sites inherit incorrect permissions.

Sensitive Information Exposure

Examples include:

Credit card numbers
Passport numbers
Social Security numbers
Customer records
Healthcare data
Intellectual property

Excessive Permissions

Users frequently accumulate permissions over time.

DSPM identifies situations where users have access to more information than necessary.

This supports the principle of least privilege.

Unclassified Sensitive Data

Organizations often possess sensitive information that has never been classified.

DSPM can identify repositories containing:

Unlabeled confidential documents
Sensitive spreadsheets
Legal contracts
Financial reports

This allows administrators to apply Microsoft Purview Information Protection labels.

Shadow AI

Shadow AI refers to employees using AI tools that have not been approved by the organization.

Examples might include:

Public AI chat services
AI writing assistants
AI coding assistants
AI document summarizers

DSPM helps organizations understand where unmanaged AI usage exists so appropriate governance decisions can be made.

Key Exam Tips

For the AB-900 exam, remember these important points:

DSPM for AI is primarily a visibility and governance solution, not an AI blocking solution.
It helps organizations discover, understand, and reduce AI-related risks.
It identifies oversharing, sensitive data exposure, and permission issues.
DSPM works closely with other Microsoft Purview solutions to improve an organization’s overall AI security posture.
Microsoft Graph provides much of the contextual information that enables DSPM to evaluate AI data access and potential risks.
The goal is not to restrict productive AI use, but to ensure that AI operates within an organization’s existing security, compliance, and governance framework.

Go to Part 2 of this topic.

Go to the AB-900 Exam Prep Hub main page

AB-900, Data Security, Microsoft Certification, security June 27, 2026

Identify user activities reported by Microsoft Purview Activity Explorer (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify data protection and governance risks for Microsoft 365 and Copilot
      --> Identify user activities reported by Microsoft Purview Activity Explorer

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand how Microsoft Purview Activity Explorer helps administrators investigate user activities involving sensitive information. Activity Explorer provides visibility into how sensitive data is accessed, shared, modified, labeled, or protected across Microsoft 365 services. It is an important investigative tool for identifying potential data protection and governance risks.

What Is Microsoft Purview Activity Explorer?

Microsoft Purview Activity Explorer is an investigation tool that displays activities involving sensitive information and Microsoft Purview protection technologies across Microsoft 365.

Rather than preventing actions, Activity Explorer helps administrators answer questions such as:

Who accessed sensitive information?
Which files contained sensitive data?
Was a sensitivity label applied or removed?
Did a Data Loss Prevention (DLP) policy trigger?
Was confidential information shared externally?
When did a particular activity occur?

Activity Explorer provides a searchable history of events so administrators can investigate potential compliance and security incidents.

Purpose of Activity Explorer

The primary purpose of Activity Explorer is to provide visibility into how organizational data is being used and protected.

It helps organizations:

Investigate compliance incidents
Monitor sensitive information usage
Validate Microsoft Purview policy effectiveness
Support audits
Identify risky user behavior
Understand how sensitive data moves throughout Microsoft 365

How Activity Explorer Fits into Microsoft Purview

Activity Explorer works alongside several Microsoft Purview solutions.

Microsoft Purview Solution	Purpose
Information Protection	Applies sensitivity labels
Data Loss Prevention (DLP)	Prevents inappropriate sharing of sensitive data
Data Classification	Identifies sensitive information
Insider Risk Management	Investigates risky user behavior
Activity Explorer	Displays activities involving protected or sensitive content

Think of Activity Explorer as the investigation dashboard that brings many of these activities together.

User Activities Reported by Activity Explorer

Activity Explorer records many different activities related to sensitive information.

1. Sensitivity Label Activities

Administrators can identify when users:

Apply sensitivity labels
Remove sensitivity labels
Change sensitivity labels
Automatically receive labels
Manually classify documents

Example:

A user changes a document from Confidential to Public.

Activity Explorer records:

User
File
Previous label
New label
Time of change

2. Data Loss Prevention (DLP) Activities

Activity Explorer reports when DLP policies detect sensitive information.

Examples include:

Email blocked
File upload blocked
USB copy blocked
External sharing blocked
Policy warning shown
Policy override used

Example:

A user attempts to email customer credit card numbers.

The DLP policy detects the data and Activity Explorer records the event.

3. Sensitive Information Detection

Activity Explorer records when Microsoft identifies sensitive information types such as:

Credit card numbers
Social Security numbers
Passport numbers
Driver’s license numbers
Bank account numbers
Tax identification numbers
Healthcare identifiers

The tool helps administrators understand where sensitive information exists.

4. File Activities

Activity Explorer can display events involving files that contain sensitive information.

Examples include:

File created
File modified
File deleted
File copied
File downloaded
File shared
File moved

5. Sharing Activities

Administrators can investigate file-sharing behavior.

Examples:

Internal sharing
External sharing
Anonymous sharing links
Sharing permission changes
Sharing sensitive documents

These activities help identify potential data exposure risks.

6. Email Activities

Activity Explorer can report events involving protected email messages.

Examples include:

Email containing sensitive information
Protected email
Label changes
DLP policy matches

7. Teams Activities

Activity Explorer includes activities related to Microsoft Teams when supported by Microsoft Purview policies.

Examples include:

Sensitive information shared in Teams chats
Files shared in Teams
DLP policy matches
Protected documents shared

8. SharePoint and OneDrive Activities

Common activities include:

Sensitive file uploads
Downloads
External sharing
Label application
DLP events
File modifications

Information Displayed for Each Activity

Each event typically includes:

Date and time
User
Workload (Exchange, Teams, SharePoint, OneDrive)
Activity type
Policy involved
Sensitive information detected
Sensitivity label
File name
Location
Severity (when applicable)

This information helps investigators quickly understand what occurred.

Filtering Activity Explorer

Administrators can filter results by:

User
Date range
Workload
Activity type
Policy
Sensitive information type
Sensitivity label
Location
Service
File name

Filtering makes investigations faster and more targeted.

Common Investigation Scenarios

Scenario 1: External File Sharing

Question:

Has confidential information been shared outside the organization?

Activity Explorer allows investigators to:

Find externally shared files
Identify the user
Determine whether a DLP policy triggered
Review sensitivity labels

Scenario 2: Sensitive Information Discovery

Question:

Where are customer Social Security numbers stored?

Activity Explorer can identify:

Files
Users
Locations
Labels
Detection events

Scenario 3: Label Investigation

Question:

Who removed the Confidential label from a document?

Activity Explorer shows:

User
Time
Original label
New label
File involved

Scenario 4: DLP Policy Review

Question:

Which users triggered the most DLP alerts this week?

Administrators can filter DLP events by:

User
Policy
Date
Severity

Relationship to Microsoft 365 Copilot

As organizations deploy Microsoft 365 Copilot, understanding how sensitive information is used becomes increasingly important.

Activity Explorer helps administrators:

Verify that sensitivity labels are being applied
Review DLP policy activity
Monitor how protected information is handled
Investigate suspicious sharing activities
Support governance for content that Copilot may reference based on users’ existing permissions

Although Activity Explorer does not monitor Copilot prompts or responses directly, it helps administrators understand the underlying data protection activities associated with Microsoft 365 content.

Difference Between Activity Explorer and Audit Logs

These tools are related but serve different purposes.

Activity Explorer	Microsoft Purview Audit
Focuses on sensitive information activities	Records broad user and administrator activities
Highlights DLP and sensitivity label events	Records nearly all Microsoft 365 events
Designed for data protection investigations	Designed for security, compliance, and auditing
Optimized for Microsoft Purview investigations	Optimized for overall audit history

Best Practices

Organizations should:

Regularly review Activity Explorer.
Investigate repeated DLP policy matches.
Monitor external sharing of sensitive files.
Review sensitivity label changes.
Use filters to focus investigations.
Integrate findings with Insider Risk Management when appropriate.
Periodically validate that Purview policies are functioning as expected.

AB-900 Exam Tips

Remember these key points for the exam:

Activity Explorer is an investigation tool.
It reports activities involving sensitive information and Microsoft Purview protections.
It displays DLP events, sensitivity label activities, sharing events, and sensitive information detections.
It helps administrators investigate compliance and governance risks.
Activity Explorer complements Audit logs but focuses specifically on data protection activities.
Administrators can filter activities by user, workload, policy, label, activity type, and date.

Practice Exam Questions

Question 1

What is the primary purpose of Microsoft Purview Activity Explorer?

A. Create Microsoft 365 user accounts

B. Display activities involving sensitive information and Microsoft Purview protections

C. Configure Conditional Access policies

D. Reset user passwords

Correct Answer: B

Explanation: Activity Explorer helps administrators investigate activities involving sensitive information, DLP events, sensitivity labels, and other Microsoft Purview protection technologies.

Question 2

Which activity would most likely appear in Activity Explorer?

A. BIOS firmware updates

B. Windows device driver installation

C. A user applies a Confidential sensitivity label to a document

D. Printer toner replacement

Correct Answer: C

Explanation: Applying or changing sensitivity labels is one of the primary activities tracked by Activity Explorer.

Question 3

Which Microsoft Purview feature commonly generates events that are visible in Activity Explorer?

A. Microsoft Intune

B. Windows Update

C. Active Directory Sites and Services

D. Data Loss Prevention (DLP)

Correct Answer: D

Explanation: Activity Explorer records DLP policy matches, alerts, overrides, and other related events.

Question 4

An administrator wants to determine who shared a sensitive document externally. Which Microsoft Purview tool should they use?

A. Activity Explorer

B. Windows Event Viewer

C. Device Manager

D. Microsoft Paint

Correct Answer: A

Explanation: Activity Explorer displays sharing activities involving sensitive information, including external sharing events.

Question 5

Which information can administrators use to filter Activity Explorer results?

A. CPU temperature

B. Printer model

C. User name, activity type, and date range

D. Network cable type

Correct Answer: C

Explanation: Activity Explorer supports filtering by user, workload, activity type, policy, label, location, and date range.

Question 6

Which statement best describes Activity Explorer?

A. It permanently blocks sensitive file sharing.

B. It investigates activities involving protected or sensitive information.

C. It replaces Microsoft Defender Antivirus.

D. It encrypts every Microsoft 365 file automatically.

Correct Answer: B

Explanation: Activity Explorer is designed for investigation and reporting rather than prevention.

Question 7

Which Microsoft 365 workloads can contribute activities to Activity Explorer?

A. Only Microsoft Excel

B. Only Microsoft Teams

C. Only Exchange Online

D. Exchange Online, SharePoint Online, OneDrive, and Microsoft Teams

Correct Answer: D

Explanation: Activity Explorer collects supported events from multiple Microsoft 365 workloads to provide a comprehensive view of sensitive data activities.

Question 8

What can an administrator determine by reviewing Activity Explorer?

A. Which BIOS version users are running

B. Which sensitive information types were detected in organizational content

C. The amount of available disk space on each device

D. Which printer is the default printer

Correct Answer: B

Explanation: Activity Explorer displays detections of sensitive information types such as credit card numbers, Social Security numbers, and other classified data.

Question 9

How does Activity Explorer differ from Microsoft Purview Audit?

A. Activity Explorer focuses on sensitive information and data protection activities, while Audit records a broader range of Microsoft 365 events.

B. Activity Explorer stores passwords.

C. Audit only records Teams activities.

D. Both tools provide identical information.

Correct Answer: A

Explanation: Activity Explorer specializes in Microsoft Purview-related activities, while Audit provides broader auditing across Microsoft 365.

Question 10

Why is Microsoft Purview Activity Explorer valuable in organizations using Microsoft 365 Copilot?

A. It records every Copilot prompt entered by users.

B. It replaces Copilot security permissions.

C. It helps administrators monitor the protection and handling of sensitive Microsoft 365 content that Copilot may access based on existing permissions.

D. It automatically blocks all Copilot responses.

Correct Answer: C

Explanation: Activity Explorer helps administrators understand how sensitive content is protected and used within Microsoft 365, supporting governance for data that Copilot can access according to user permissions.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Security, Data Governance, Data Security, Microsoft Certification, security June 27, 2026

Identify policy violations generated by Communication Compliance (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify data protection and governance risks for Microsoft 365 and Copilot
      --> Identify policy violations generated by Communication Compliance

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand how Microsoft Purview Communication Compliance helps organizations detect, investigate, and respond to inappropriate communications that may violate corporate policies, legal requirements, or regulatory standards. You should also understand how administrators review policy matches, investigate alerts, and take appropriate remediation actions.

What is Microsoft Purview Communication Compliance?

Microsoft Purview Communication Compliance is a Microsoft Purview solution that helps organizations detect and investigate inappropriate or risky communications across Microsoft 365 services.

Rather than preventing users from communicating, Communication Compliance monitors communications and alerts authorized reviewers when messages match organizational policies.

It helps organizations detect communications involving:

Harassment
Discrimination
Offensive language
Threats
Confidential information sharing
Regulatory violations
Inappropriate behavior
Insider risks

Communication Compliance is designed to reduce legal, compliance, and reputational risks while helping organizations meet industry regulations.

Why Communication Compliance Is Important

Organizations communicate constantly using:

Microsoft Teams chats
Teams channel messages
Outlook emails
Viva Engage (Yammer)
Third-party communication platforms (through supported connectors)

Without monitoring, inappropriate communications may:

Create hostile work environments
Lead to lawsuits
Violate government regulations
Expose confidential information
Damage an organization’s reputation

Communication Compliance provides visibility into these risks.

What Are Policy Violations?

A policy violation occurs when a communication matches conditions defined within a Communication Compliance policy.

Examples include:

Use of offensive language
Bullying or harassment
Sharing confidential customer information
Threatening another employee
Insider trading discussions
Regulatory compliance violations
Sharing protected intellectual property

A policy violation does not automatically mean misconduct occurred.

Instead, it means the communication requires human review.

How Communication Compliance Works

The workflow follows several stages.

Step 1: Create a Policy

Administrators create policies that define:

Users or groups to monitor
Communication locations
Types of violations
Detection conditions
Review workflow

Step 2: Monitor Communications

Communication Compliance continuously analyzes supported communications.

Examples include:

Teams messages
Emails
Viva Engage posts

Content is evaluated against policy conditions.

Step 3: Generate Alerts

If content matches a policy:

An alert is generated.
The alert appears in the Communication Compliance dashboard.
Reviewers receive notification.

Step 4: Human Review

Authorized reviewers investigate:

Original message
Conversation context
Users involved
Severity
Previous incidents

Reviewers determine whether the communication truly violated policy.

Step 5: Resolution

Reviewers choose an appropriate action, such as:

Resolve as compliant
Confirm violation
Escalate investigation
Notify HR
Notify legal
Train employee
Document findings

Common Types of Policy Violations

Harassment

Detects communications containing:

Insults
Bullying
Abusive language
Threats

Example:

“You’re completely useless and should quit.”

Discrimination

Detects language involving:

Race
Gender
Religion
Disability
Age
Protected characteristics

Offensive Language

Identifies:

Profanity
Hate speech
Offensive expressions

Sensitive Information Sharing

Detects messages containing:

Credit card numbers
Social Security numbers
Customer information
Financial records
Medical information

Regulatory Compliance Violations

Organizations in regulated industries monitor communications involving:

Insider trading
Market manipulation
Financial misconduct
Unauthorized disclosures

Confidential Information

Detects unauthorized sharing of:

Trade secrets
Product designs
Internal reports
Source code
Financial forecasts

Policy Alerts

A Communication Compliance alert contains information such as:

Policy name
Date and time
Severity
User involved
Communication type
Matched rule
Review status

Alerts help reviewers prioritize investigations.

Alert Severity

Organizations often classify alerts as:

Low

Minor language concerns.

Example:

A mildly inappropriate joke.

Medium

Behavior that may violate company policy.

Example:

Repeated offensive language.

High

Serious compliance concern.

Example:

Threats of violence or disclosure of confidential data.

Reviewing Policy Violations

Authorized reviewers access the Communication Compliance portal.

During review they can examine:

Conversation history
Message participants
Attachments
Policy triggered
Matching keywords
Previous incidents
Related alerts

Context is important because individual messages may appear harmless without surrounding conversation.

Investigation Workflow

A typical investigation includes:

Open the alert.
Review message details.
Examine conversation context.
Determine whether policy was actually violated.
Assign a review outcome.
Document findings.
Close or escalate the case.

Possible Review Outcomes

Reviewers may classify alerts as:

No violation
Violation confirmed
Needs escalation
False positive
Resolved

These outcomes help improve future policy effectiveness.

False Positives

Not every alert represents an actual violation.

Examples include:

Educational discussions
Medical terminology
Technical documentation
Quoted material
Sarcasm
Context misunderstood by automated analysis

Human review remains essential.

Improving Detection Accuracy

Organizations can improve policy effectiveness by:

Updating keyword dictionaries
Using machine learning classifiers
Adjusting policy thresholds
Creating separate policies for departments
Reviewing false positives
Refining monitored user groups

Who Reviews Violations?

Communication Compliance uses role-based access control.

Typical reviewers include:

Compliance administrators
Compliance officers
Human Resources
Legal teams
Risk investigators

Only authorized personnel can review sensitive communications.

Privacy Considerations

Communication Compliance is designed with privacy controls.

Organizations can:

Limit reviewer access
Use pseudonymization (where supported)
Restrict investigations
Audit reviewer actions
Follow regional privacy laws

Integration with Other Microsoft Security Solutions

Communication Compliance works alongside several Microsoft security solutions.

Microsoft Purview Insider Risk Management

Communication Compliance findings may support insider risk investigations involving suspicious employee behavior.

Microsoft Purview Data Loss Prevention (DLP)

DLP prevents unauthorized sharing of sensitive information, while Communication Compliance reviews the content and context of communications.

Microsoft Purview Information Protection

Sensitivity labels applied to documents help reviewers understand the sensitivity of shared information.

Microsoft Defender

Security incidents and user risk signals can complement Communication Compliance investigations.

Communication Compliance and Microsoft 365 Copilot

As organizations adopt Microsoft 365 Copilot, Communication Compliance remains important because users increasingly collaborate through Teams, Outlook, and other Microsoft 365 services that Copilot can reference based on existing permissions.

If inappropriate communications occur, Communication Compliance can:

Detect policy violations
Assist investigations
Support regulatory compliance
Help protect organizational reputation
Complement broader Microsoft Purview governance capabilities

Best Practices

For the AB-900 exam, remember these best practices:

Monitor communications using clearly defined policies.
Review alerts promptly.
Always investigate message context before making decisions.
Use authorized reviewers only.
Tune policies to reduce false positives.
Protect employee privacy while maintaining compliance.
Integrate Communication Compliance with broader Microsoft Purview governance.

AB-900 Exam Tips

Remember these key points:

Communication Compliance monitors communications—it does not block them.
Policy violations generate alerts, not automatic disciplinary actions.
Human reviewers determine whether a true violation occurred.
Context matters when reviewing communications.
Communication Compliance supports compliance, legal, HR, and risk management teams.
Alerts can detect harassment, discrimination, offensive language, regulatory violations, and sensitive information sharing.
Communication Compliance works together with Insider Risk Management, DLP, Information Protection, and Microsoft Defender.

Practice Exam Questions

Question 1

What is the primary purpose of Microsoft Purview Communication Compliance?

A. Encrypt all Microsoft Teams messages

B. Detect and investigate communications that may violate organizational policies

C. Prevent users from sending emails

D. Back up Microsoft 365 communications

Correct Answer: B

Explanation: Communication Compliance monitors supported communications and generates alerts when messages match configured compliance policies.

Question 2

A Communication Compliance alert indicates that a Teams message matched a harassment policy. What should happen next?

A. The user account is automatically disabled.

B. The message is permanently deleted.

C. An authorized reviewer investigates the communication.

D. The policy is automatically removed.

Correct Answer: C

Explanation: Communication Compliance generates alerts for human review rather than taking automatic disciplinary actions.

Question 3

Which type of communication can Microsoft Purview Communication Compliance monitor?

A. BIOS startup messages

B. Local Windows Event Logs

C. Microsoft Teams chats

D. Printer configuration files

Correct Answer: C

Explanation: Teams chats are one of the primary communication sources monitored by Communication Compliance.

Question 4

Why is conversation context important when reviewing alerts?

A. It determines network bandwidth.

B. It identifies device drivers.

C. It encrypts communications.

D. It helps reviewers determine whether a message truly violates policy.

Correct Answer: D

Explanation: Individual messages may appear inappropriate when viewed alone but may be acceptable within the full conversation.

Question 5

Which activity is an example of a Communication Compliance policy violation?

A. Updating Windows patches

B. Sharing vacation schedules

C. Sending offensive or harassing messages to coworkers

D. Resetting a forgotten password

Correct Answer: C

Explanation: Offensive or harassing communications are common scenarios monitored by Communication Compliance.

Question 6

Who should review Communication Compliance alerts?

A. Any employee

B. Only authorized compliance reviewers

C. External customers

D. Guest users

Correct Answer: B

Explanation: Access to Communication Compliance investigations is limited through role-based access control.

Question 7

What is a false positive in Communication Compliance?

A. A communication incorrectly identified as violating policy

B. A deleted user account

C. An expired Microsoft 365 license

D. A successful malware scan

Correct Answer: A

Explanation: False positives occur when automated detection flags communications that are ultimately determined not to violate policy.

Question 8

Which Microsoft Purview solution focuses primarily on preventing sensitive information from leaving the organization?

A. Communication Compliance

B. Insider Risk Management

C. Data Loss Prevention (DLP)

D. Compliance Manager

Correct Answer: C

Explanation: DLP is designed to detect and prevent unauthorized sharing of sensitive information, while Communication Compliance focuses on reviewing communications.

Question 9

What does a Communication Compliance alert indicate?

A. A confirmed policy violation requiring disciplinary action

B. A communication matched a configured policy and should be reviewed

C. The user’s account has been compromised

D. Microsoft 365 licensing has expired

Correct Answer: B

Explanation: Alerts indicate potential policy matches that require investigation; they are not proof of wrongdoing.

Question 10

Which statement best describes Microsoft Purview Communication Compliance?

A. It replaces antivirus software.

B. It automatically blocks every risky message.

C. It permanently archives all Microsoft 365 files.

D. It helps organizations identify, investigate, and respond to inappropriate communications.

Correct Answer: D

Explanation: Communication Compliance helps organizations manage communication-related compliance risks through monitoring, alerting, investigation, and response.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Governance, Data Governance, Data Security, Microsoft Certification June 27, 2026

Identify sensitive information by using Microsoft Purview Data Explorer (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify data protection and governance risks for Microsoft 365 and Copilot
      --> Identify sensitive information by using Microsoft Purview Data Explorer

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

As organizations increasingly rely on Microsoft 365 and Microsoft 365 Copilot, understanding where sensitive information resides has become a critical governance and security requirement. Sensitive data such as credit card numbers, Social Security numbers, health records, financial information, intellectual property, and confidential business documents can create significant compliance and security risks if not properly managed.

Microsoft Purview Data Explorer helps organizations discover, analyze, and understand sensitive information stored across Microsoft 365 services. It provides visibility into the location, volume, and classification of sensitive data, enabling administrators to make informed decisions about data protection, governance, compliance, and Copilot readiness.

For the AB-900 exam, you should understand the purpose of Data Explorer, how it identifies sensitive information, the types of information it can discover, and how organizations use its insights to reduce compliance and governance risks.

What Is Microsoft Purview Data Explorer?

Microsoft Purview Data Explorer is a reporting and investigation tool within Microsoft Purview that helps administrators visualize and analyze sensitive data across Microsoft 365 environments.

Data Explorer enables organizations to:

Discover sensitive information
Understand where sensitive data is stored
Analyze data classification results
Identify compliance risks
Support data governance initiatives
Validate Microsoft Purview policy effectiveness
Improve Microsoft 365 Copilot readiness

Rather than protecting data directly, Data Explorer provides visibility into an organization’s data landscape so administrators can take appropriate actions.

Why Data Discovery Is Important

Organizations often accumulate large amounts of data over time. Without visibility into that data, administrators may not know:

What sensitive information exists
Where the information is stored
Who has access to it
Whether it is properly protected
Whether regulatory requirements are being met

For example:

Customer records may contain personally identifiable information (PII).
Financial documents may contain account numbers.
Healthcare records may contain protected health information (PHI).
Contracts may contain confidential business information.

Data Explorer helps identify these risks before they become security or compliance issues.

How Data Explorer Works

Data Explorer analyzes Microsoft 365 content using classification technologies available in Microsoft Purview.

The system scans content stored in supported locations and identifies:

Sensitive information types
Sensitivity labels
Trainable classifiers
Retention labels
Data classifications

The results are then presented through visual dashboards and detailed reports.

Administrators can use these reports to understand the organization’s sensitive data footprint.

Data Sources Analyzed by Data Explorer

Data Explorer can analyze content across Microsoft 365 services, including:

SharePoint Online

Examples:

Documents
Team sites
Department sites
Project repositories

OneDrive for Business

Examples:

Personal work files
Shared documents
Business records

Exchange Online

Examples:

Email messages
Attachments
Mailbox content

Microsoft Teams

Examples:

Shared files
Team documents
Collaboration content

These locations often contain the information that Microsoft 365 Copilot accesses when generating responses.

Sensitive Information Types (SITs)

One of the primary ways Data Explorer identifies sensitive information is through Sensitive Information Types (SITs).

Sensitive Information Types are predefined patterns that identify specific categories of sensitive data.

Examples include:

Social Security Numbers
Credit Card Numbers
Driver’s License Numbers
Passport Numbers
Tax Identification Numbers
Bank Account Numbers
Healthcare Information

Microsoft provides hundreds of built-in sensitive information types.

Organizations can also create custom sensitive information types.

Trainable Classifiers

Data Explorer can also identify information using trainable classifiers.

Unlike pattern matching, trainable classifiers use machine learning to recognize content based on context.

Examples include:

Resumes
Contracts
Invoices
Financial documents
Source code
Intellectual property

This helps organizations classify content that may not contain obvious patterns such as account numbers or IDs.

Sensitivity Labels and Data Explorer

Organizations often use sensitivity labels to classify and protect information.

Examples of labels include:

Public
General
Confidential
Highly Confidential

Data Explorer can show:

Which files have sensitivity labels
Label distribution across the organization
Unlabeled sensitive content
Areas where additional labeling may be needed

This visibility helps improve data governance and security.

Retention Labels and Data Explorer

Retention labels determine how long content should be retained and when it should be deleted.

Data Explorer can help organizations understand:

Which files have retention labels
Which files lack retention labels
Data that may require retention controls
Potential records management gaps

Data Classification Overview

Data classification is the process of identifying and categorizing information according to its sensitivity and business value.

Data Explorer supports classification efforts by helping organizations:

Locate sensitive data
Understand risk exposure
Apply appropriate protections
Improve compliance programs

The classification process typically includes:

Discover data
Classify data
Protect data
Monitor data
Govern data

Data Explorer primarily supports the discovery and analysis phases.

Visualizations and Reporting

Data Explorer provides dashboards and reports that help administrators quickly understand sensitive data trends.

Reports can show:

Number of sensitive items
Sensitive information types detected
Label usage
Data locations
Content trends
Classification coverage

These visualizations help administrators identify areas requiring additional protection.

Data Explorer and Microsoft 365 Copilot

Data Explorer plays an important role in Copilot readiness assessments.

Because Microsoft 365 Copilot uses existing permissions and accesses organizational data through Microsoft Graph, organizations should understand what data exists before deploying Copilot broadly.

Data Explorer helps identify:

Overexposed sensitive data
Unclassified content
Excessively shared files
Confidential documents lacking protection
Data governance gaps

Administrators can use these insights to improve security before expanding Copilot adoption.

Common Governance Risks Identified by Data Explorer

Unlabeled Sensitive Data

Sensitive documents may exist without sensitivity labels.

Risk:

Users may accidentally share confidential information.

Recommended Action:

Apply sensitivity labels.

Excessive Data Exposure

Sensitive files may be accessible to too many users.

Risk:

Unauthorized access.

Recommended Action:

Review permissions and sharing settings.

Missing Retention Controls

Important records may lack retention policies.

Risk:

Regulatory violations.

Recommended Action:

Implement retention labels and policies.

Sensitive Data in Unexpected Locations

Data may be stored outside approved repositories.

Risk:

Governance challenges.

Recommended Action:

Review storage practices and apply controls.

Relationship with Other Microsoft Purview Solutions

Data Explorer works alongside other Microsoft Purview solutions.

Information Protection

Provides:

Sensitivity labels
Encryption
Classification

Data Explorer shows where protected and unprotected content exists.

Data Loss Prevention (DLP)

Provides:

Policy enforcement
Data movement restrictions

Data Explorer helps identify data that may require DLP protection.

Insider Risk Management

Provides:

Risk detection
Insider threat analysis

Data Explorer helps identify sensitive data that could be targeted.

Compliance Manager

Provides:

Compliance assessments
Risk reduction recommendations

Data Explorer provides visibility into the data that compliance programs are designed to protect.

Benefits of Using Data Explorer

Organizations use Data Explorer to:

Discover sensitive information
Improve data governance
Support regulatory compliance
Prepare for Copilot deployment
Validate classification strategies
Identify protection gaps
Reduce organizational risk
Improve visibility into data assets

Key Exam Tips

For the AB-900 exam, remember the following:

Data Explorer helps organizations discover and analyze sensitive information.
It provides visibility into sensitive data locations across Microsoft 365.
Sensitive Information Types identify structured sensitive data such as Social Security numbers and credit card numbers.
Trainable classifiers identify content based on context and machine learning.
Data Explorer supports governance, compliance, and Copilot readiness initiatives.
It helps identify unlabeled, unprotected, or overexposed sensitive information.
Data Explorer is primarily a discovery and analysis tool, not a protection or enforcement tool.
Data Explorer works with sensitivity labels, retention labels, DLP, and other Microsoft Purview solutions.

Practice Exam Questions

Question 1

What is the primary purpose of Microsoft Purview Data Explorer?

A. Generate AI responses for users

B. Discover and analyze sensitive information across Microsoft 365

C. Encrypt all organizational files

D. Replace Microsoft Defender

Answer: B

Explanation: Data Explorer is designed to help organizations discover, analyze, and understand sensitive information stored across Microsoft 365 services.

Question 2

Which Microsoft 365 service can be analyzed by Data Explorer?

A. SharePoint Online

B. Windows Server

C. Hyper-V

D. Microsoft Intune only

Answer: A

Explanation: Data Explorer can analyze content stored in SharePoint Online, OneDrive, Exchange Online, Teams, and other supported Microsoft 365 locations.

Question 3

What is a Sensitive Information Type (SIT)?

A. A method for creating Teams meetings

B. A licensing model for Microsoft Purview

C. A predefined pattern used to identify sensitive information

D. A backup technology

Answer: C

Explanation: Sensitive Information Types are predefined detectors that identify sensitive data such as Social Security numbers and credit card numbers.

Question 4

Which technology helps identify content such as contracts and resumes using context rather than pattern matching?

A. DLP policies

B. Retention labels

C. Sensitivity labels

D. Trainable classifiers

Answer: D

Explanation: Trainable classifiers use machine learning and contextual analysis to identify document types such as contracts, resumes, and invoices.

Question 5

An administrator wants to determine whether confidential files lack sensitivity labels. Which tool should they use?

A. Microsoft Planner

B. Microsoft Lists

C. Microsoft Purview Data Explorer

D. Microsoft Whiteboard

Answer: C

Explanation: Data Explorer can identify sensitive content and show whether appropriate sensitivity labels have been applied.

Question 6

Which statement best describes Data Explorer?

A. It automatically blocks all file sharing.

B. It discovers and reports on sensitive information.

C. It replaces retention policies.

D. It automatically deletes noncompliant content.

Answer: B

Explanation: Data Explorer focuses on visibility and analysis rather than directly enforcing protection actions.

Question 7

Why is Data Explorer valuable before deploying Microsoft 365 Copilot broadly?

A. It upgrades Copilot licenses.

B. It improves Teams meeting quality.

C. It increases mailbox storage.

D. It helps identify sensitive or overexposed data that Copilot could potentially access.

Answer: D

Explanation: Understanding data exposure and classification gaps helps organizations prepare for secure Copilot adoption.

Question 8

Which item would most likely be identified through a built-in Sensitive Information Type?

A. A company strategy presentation

B. A software design diagram

C. A credit card number

D. A project timeline

Answer: C

Explanation: Sensitive Information Types are designed to detect structured data such as credit card numbers, passport numbers, and Social Security numbers.

Question 9

What governance risk might Data Explorer help identify?

A. Unlabeled sensitive documents

B. Printer driver issues

C. Network latency

D. Browser compatibility problems

Answer: A

Explanation: Data Explorer helps identify sensitive content that lacks classification or protection controls.

Question 10

How does Data Explorer support data governance?

A. By replacing all security controls

B. By automatically enforcing compliance regulations

C. By eliminating the need for sensitivity labels

D. By providing visibility into sensitive data and classification coverage

Answer: D

Explanation: Data Explorer supports governance efforts by helping organizations understand where sensitive information exists and whether appropriate classifications and protections are in place.

Exam Summary

Microsoft Purview Data Explorer is a discovery and analysis tool that helps organizations identify sensitive information across Microsoft 365. It uses Sensitive Information Types, trainable classifiers, sensitivity labels, and retention labels to provide visibility into data risks and governance gaps. Data Explorer is particularly important for compliance initiatives and Microsoft 365 Copilot readiness because it helps organizations understand what sensitive information exists, where it is stored, and whether it is properly protected. Understanding how Data Explorer identifies and reports sensitive information is an important objective for the AB-900 certification exam.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI, AI Governance, Data Security, Microsoft Certification June 27, 2026

Understand responsible AI principles (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Understand data security implications of Copilot
      --> Understand responsible AI principles

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

As organizations increasingly adopt artificial intelligence (AI) technologies such as Microsoft 365 Copilot and custom AI agents, it is essential that these systems are designed, deployed, and used responsibly. Responsible AI refers to the practice of developing and using AI systems in ways that are ethical, trustworthy, secure, transparent, and beneficial to individuals and society.

Microsoft has established a framework of Responsible AI principles that guide the development and operation of AI solutions, including Microsoft 365 Copilot. These principles help organizations maximize the benefits of AI while minimizing risks such as bias, privacy violations, misinformation, and security threats.

For the AB-900 exam, it is important to understand Microsoft’s Responsible AI principles and how they apply to Microsoft 365 Copilot and AI-powered business solutions.

What Is Responsible AI?

Responsible AI is the practice of designing, building, deploying, and managing AI systems in a way that:

Benefits people and organizations
Respects privacy and security
Promotes fairness
Provides transparency
Maintains accountability
Prevents harm

Responsible AI recognizes that AI systems can significantly influence business decisions, productivity, communication, and access to information. Therefore, safeguards must be implemented to ensure AI is used appropriately.

Why Responsible AI Matters

AI systems can create significant value, but they also introduce potential risks, including:

Biased or unfair outcomes
Exposure of sensitive information
Inaccurate or misleading responses
Security vulnerabilities
Regulatory compliance issues
Lack of transparency regarding AI-generated content

Responsible AI principles help organizations manage these risks while maintaining trust in AI technologies.

Microsoft’s Six Responsible AI Principles

Microsoft’s Responsible AI Standard is built around six core principles:

Fairness
Reliability and Safety
Privacy and Security
Inclusiveness
Transparency
Accountability

These principles guide Microsoft’s development of AI technologies, including Microsoft 365 Copilot.

Principle 1: Fairness

Fairness means AI systems should treat individuals and groups equitably and avoid unjust bias.

AI models may unintentionally learn patterns that reflect historical biases found in training data. Responsible AI practices aim to reduce these biases and ensure fair treatment.

Examples of Fairness

Recruiting systems should not favor candidates based on protected characteristics.
AI-generated recommendations should not systematically disadvantage specific groups.
Business decisions supported by AI should be evaluated for potential bias.

Copilot Example

If Copilot assists with content creation or summarization, organizations should review outputs to ensure they do not contain biased assumptions or discriminatory language.

Principle 2: Reliability and Safety

Reliability and Safety ensure AI systems perform consistently and operate as intended.

AI-generated responses may occasionally contain errors, hallucinations, or incomplete information. Organizations should implement safeguards to reduce risk.

Reliability Considerations

AI outputs should be reviewed before critical decisions are made.
Systems should be tested under various conditions.
Security controls should protect AI services from misuse.

Copilot Example

Users should verify important financial, legal, or regulatory information generated by Copilot before acting on it.

Principle 3: Privacy and Security

Privacy and Security focus on protecting data from unauthorized access and ensuring information is handled appropriately.

AI systems often process large amounts of organizational data. Strong security controls are essential.

Key Protections

Authentication and authorization
Encryption
Access controls
Data governance
Compliance policies

Copilot Example

Microsoft 365 Copilot respects existing permissions and uses permission trimming to ensure users only access authorized information.

Principle 4: Inclusiveness

Inclusiveness means AI systems should be accessible and useful to people with diverse abilities, backgrounds, and needs.

Inclusive design helps ensure that AI technologies benefit the widest possible range of users.

Examples

Accessibility support for individuals with disabilities
Multiple language capabilities
User experiences that accommodate diverse needs

Copilot Example

Copilot supports users through natural language interactions, helping make technology more accessible to individuals with varying technical skill levels.

Principle 5: Transparency

Transparency means users should understand when AI is being used and how AI-generated content is produced.

Organizations should be able to explain:

When content was AI-generated
What data sources influenced results
The limitations of AI outputs

Transparency in Copilot

Microsoft provides citations and references in many Copilot experiences to help users understand where information originated.

Users should recognize that AI-generated content may require validation and review.

Principle 6: Accountability

Accountability means humans remain responsible for AI systems and their outcomes.

AI should assist decision-making rather than replace human judgment.

Organizations should establish governance processes that define:

Who oversees AI usage
Who approves deployments
How risks are managed
How incidents are investigated

Copilot Example

Employees remain responsible for reviewing, validating, and approving content generated by Copilot before sharing or acting on it.

Responsible AI and Microsoft 365 Copilot

Microsoft 365 Copilot incorporates Responsible AI principles throughout its design.

Security and Privacy

Copilot:

Uses Microsoft Graph permissions
Enforces permission trimming
Respects sensitivity labels
Honors DLP policies

Transparency

Copilot often provides references and citations to source content.

Accountability

Users remain responsible for reviewing generated outputs.

Reliability

Grounding with Microsoft Graph helps improve response quality and relevance.

Human Oversight and AI

A key Responsible AI concept is human oversight.

Organizations should not blindly trust AI-generated outputs.

Users should:

Review AI-generated content
Verify factual accuracy
Check calculations
Confirm compliance requirements
Validate business recommendations

This is especially important when AI-generated content affects:

Customers
Financial decisions
Legal matters
Regulatory compliance
Healthcare outcomes

AI Hallucinations and Responsible Use

An AI hallucination occurs when an AI system generates information that sounds plausible but is inaccurate or fabricated.

Examples include:

Invented facts
Incorrect citations
Misinterpreted data
False conclusions

Responsible AI practices encourage users to:

Verify information
Cross-check important outputs
Use trusted source material
Apply human judgment

For the AB-900 exam, remember that Copilot can generate incorrect information and should not be considered infallible.

Responsible AI Governance

Organizations should establish governance processes for AI use.

Common governance activities include:

Defining AI usage policies
Monitoring AI systems
Reviewing AI-generated content
Managing compliance requirements
Auditing AI activities
Training users on responsible AI practices

Microsoft Purview and Microsoft Defender help organizations implement governance and security controls around AI usage.

Responsible AI and Compliance

Responsible AI also supports compliance with regulatory requirements and industry standards.

Examples include:

Data privacy regulations
Industry-specific compliance frameworks
Information protection policies
Data retention requirements

Microsoft 365 security and compliance tools help organizations align AI usage with these requirements.

Key Exam Tips

For the AB-900 exam, remember:

Responsible AI focuses on ethical, trustworthy, and secure AI use.
Microsoft’s six Responsible AI principles are:
- Fairness
- Reliability and Safety
- Privacy and Security
- Inclusiveness
- Transparency
- Accountability
Copilot incorporates Responsible AI principles into its design.
Permission trimming helps support privacy and security.
Human oversight remains essential when using AI-generated content.
AI-generated outputs can contain errors or hallucinations.
Transparency helps users understand AI-generated content.
Accountability remains with people and organizations, not the AI system itself.
Responsible AI governance helps reduce business and compliance risks.

Practice Exam Questions

Question 1

Which Microsoft Responsible AI principle focuses on ensuring AI systems do not unfairly disadvantage certain individuals or groups?

A. Fairness
B. Transparency
C. Accountability
D. Reliability and Safety

Answer: A

Explanation: Fairness seeks to minimize bias and ensure equitable treatment across individuals and groups.

Question 2

What is the primary goal of the Reliability and Safety principle?

A. Restrict access to Microsoft Graph
B. Ensure AI systems operate consistently and safely
C. Classify documents automatically
D. Eliminate the need for human oversight

Answer: B

Explanation: Reliability and Safety focus on ensuring AI systems function as intended and minimize harmful outcomes.

Question 3

Which Responsible AI principle emphasizes protecting sensitive data and preventing unauthorized access?

A. Inclusiveness
B. Privacy and Security
C. Transparency
D. Accountability

Answer: B

Explanation: Privacy and Security focus on safeguarding data through appropriate protections and controls.

Question 4

Which Responsible AI principle ensures that humans remain responsible for AI outcomes?

A. Fairness
B. Accountability
C. Inclusiveness
D. Reliability and Safety

Answer: B

Explanation: Accountability ensures that people and organizations maintain responsibility for AI system decisions and outcomes.

Question 5

Why is human oversight important when using Microsoft 365 Copilot?

A. Copilot cannot access Microsoft Graph
B. AI-generated content may contain inaccuracies or hallucinations
C. Copilot automatically deletes organizational data
D. Human oversight improves network performance

Answer: B

Explanation: AI systems can generate incorrect information, making human review and validation essential.

Question 6

Which Responsible AI principle focuses on making AI systems accessible to users with diverse backgrounds and abilities?

A. Privacy and Security
B. Transparency
C. Inclusiveness
D. Accountability

Answer: C

Explanation: Inclusiveness promotes accessibility and usability for a broad range of users.

Question 7

What is an AI hallucination?

A. A security breach caused by malware
B. A situation where AI generates inaccurate or fabricated information
C. A failure of multifactor authentication
D. An encrypted response from Microsoft Graph

Answer: B

Explanation: Hallucinations occur when AI generates information that appears plausible but is incorrect or fabricated.

Question 8

Which Responsible AI principle helps users understand how AI-generated content was produced?

A. Accountability
B. Fairness
C. Reliability and Safety
D. Transparency

Answer: D

Explanation: Transparency helps users understand AI processes, limitations, and content origins.

Question 9

How does Microsoft 365 Copilot support the Privacy and Security principle?

A. By bypassing permissions when generating responses
B. By ignoring compliance policies
C. By enforcing permission trimming and existing access controls
D. By storing all prompts publicly

Answer: C

Explanation: Copilot respects existing permissions and security controls, helping protect sensitive information.

Question 10

Which statement best reflects Responsible AI practices?

A. AI should replace all human decision-making.
B. AI-generated outputs should be accepted without review.
C. Accountability belongs entirely to the AI model.
D. Organizations should govern, monitor, and review AI usage.

Answer: D

Explanation: Responsible AI requires governance, oversight, monitoring, and human accountability for AI systems and their outputs.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Security, Data Security, Microsoft Certification June 27, 2026

Understand how Copilot accesses data (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Understand data security implications of Copilot
      --> Understand how Copilot accesses data

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

One of the most important concepts for the AB-900 exam is understanding how Microsoft 365 Copilot accesses and uses organizational data. Many organizations are excited about the productivity benefits of Copilot but also want assurance that sensitive information remains protected.

Microsoft 365 Copilot is designed to work within an organization’s existing Microsoft 365 security, compliance, identity, and permission boundaries. Rather than creating a separate copy of organizational data, Copilot accesses information that users already have permission to access.

Understanding how Copilot retrieves, processes, and presents data is critical for administrators responsible for security, governance, and compliance.

What Is Microsoft 365 Copilot?

Microsoft 365 Copilot is an AI-powered assistant that combines:

Large Language Models (LLMs)
Microsoft Graph
Microsoft 365 applications
Organizational data

Copilot helps users:

Draft documents
Summarize meetings
Analyze data
Generate presentations
Answer questions
Perform business tasks more efficiently

The intelligence of Copilot comes from combining AI reasoning with an organization’s business data.

The Three Main Components of Copilot Data Access

Microsoft 365 Copilot relies on three major components:

Large Language Models (LLMs)

LLMs provide:

Natural language understanding
Reasoning capabilities
Content generation
Summarization

The LLM interprets the user’s prompt and generates responses.

Microsoft Graph

Microsoft Graph serves as the bridge between Copilot and organizational data.

Microsoft Graph connects to resources such as:

Emails
Calendars
Teams chats
Teams meetings
SharePoint documents
OneDrive files
Contacts
Tasks

Graph provides context that allows Copilot to generate relevant and personalized responses.

Microsoft 365 Data

Copilot accesses information stored within Microsoft 365 services.

Examples include:

Exchange Online mailboxes
SharePoint sites
OneDrive content
Teams conversations
Meeting transcripts
Microsoft Loop content

This organizational content provides the business context used to answer user requests.

How Copilot Processes a User Request

When a user submits a prompt, several steps occur.

Step 1: User Enters a Prompt

Example:

“Summarize the latest project updates from my team.”

Step 2: Copilot Interprets the Request

The LLM analyzes:

User intent
Context
Required information

Step 3: Microsoft Graph Retrieves Relevant Data

Microsoft Graph searches content the user is authorized to access.

Potential sources include:

Emails
Documents
Teams messages
Meeting notes

Step 4: Security Permissions Are Checked

Before data is returned:

Existing permissions are evaluated
Access controls are enforced
Security boundaries remain intact

If a user cannot access content directly, Copilot cannot use it in a response.

Step 5: Response Generation

The LLM combines:

User prompt
Retrieved business data
Organizational context

A response is generated and returned to the user.

Copilot Respects Existing Permissions

One of the most important exam concepts is:

Copilot Does Not Grant Additional Access

Copilot only accesses information a user already has permission to access.

For example:

If User A can view a SharePoint document, Copilot may use that document.
If User B cannot view the document, Copilot cannot expose it.

Copilot does not bypass:

SharePoint permissions
OneDrive permissions
Teams permissions
Microsoft 365 security controls

A common Microsoft phrase is:

“Copilot honors existing permissions.”

Role of Microsoft Graph

Microsoft Graph is central to Copilot’s operation.

Microsoft Graph:

Connects Microsoft 365 services
Provides contextual information
Retrieves relevant content
Applies user permissions

Without Microsoft Graph, Copilot would not have access to organizational context.

Think of Microsoft Graph as the intelligence layer that helps Copilot locate relevant business information.

Grounding

A key Copilot concept is grounding.

Grounding means enriching AI responses with organizational data retrieved through Microsoft Graph.

Without grounding:

Responses are based primarily on general AI knowledge.

With grounding:

Responses include organization-specific information.

Example:

A user asks:

“What decisions were made during yesterday’s budget meeting?”

Copilot can retrieve:

Meeting transcripts
Notes
Shared documents

The response is grounded in actual organizational content.

Data Sources Used by Copilot

Common Microsoft 365 data sources include:

Exchange Online

Provides:

Emails
Calendars
Contacts

SharePoint Online

Provides:

Team documents
Knowledge repositories
Project files

OneDrive

Provides:

Personal work files
User-owned documents

Microsoft Teams

Provides:

Chat messages
Meeting transcripts
Channel conversations
Shared files

Microsoft Loop

Provides:

Collaborative workspaces
Shared project information

Security Boundaries and Data Access

Copilot operates within existing Microsoft 365 security boundaries.

These include:

User permissions
Group memberships
SharePoint access controls
Teams membership
Sensitivity labels
Conditional Access policies

Security controls continue to function exactly as they would without Copilot.

Copilot and Sensitivity Labels

Sensitivity labels remain effective when Copilot accesses content.

If a document is protected with a sensitivity label:

Existing protections remain in place.
Access restrictions continue to apply.
Users without permission cannot access protected information through Copilot.

This helps maintain compliance and data security.

Copilot and Data Loss Prevention (DLP)

Microsoft Purview DLP policies continue to protect data.

DLP can help:

Detect sensitive information
Restrict inappropriate sharing
Prevent data leakage

Copilot operates within these governance controls.

Copilot and Retention Policies

Retention settings remain active for Copilot-accessed content.

If content:

Is retained, Copilot may use it if the user has access.
Has been deleted according to retention policies, it generally becomes unavailable for Copilot use.

Organizations should understand that Copilot relies on content already stored in Microsoft 365.

Copilot and Identity Management

Microsoft Entra ID plays a critical role in determining what data Copilot can access.

Entra ID provides:

Authentication
Authorization
User identity verification
Access control enforcement

Every Copilot interaction is tied to an authenticated user identity.

Why Permission Management Matters

Because Copilot honors existing permissions, organizations should regularly review:

Excessive access rights
Oversharing
Legacy permissions
Inactive accounts
SharePoint permissions
Teams memberships

Poor permission management can expose information through both traditional access methods and Copilot.

Many organizations conduct permission reviews before deploying Microsoft 365 Copilot.

Data Privacy and Copilot

Microsoft states that organizational prompts, responses, and data used by Microsoft 365 Copilot:

Stay within the Microsoft 365 service boundary
Are protected by existing Microsoft 365 compliance controls
Are not used to train foundation models for other customers

This helps organizations maintain privacy and regulatory compliance.

Common Misconceptions

Misconception 1: Copilot Can See Everything

False.

Copilot only accesses data the current user is authorized to access.

Misconception 2: Copilot Creates New Security Risks by Itself

Not exactly.

Copilot exposes existing permission issues more visibly, but it does not bypass security controls.

Misconception 3: Copilot Stores Separate Copies of All Data

False.

Copilot primarily retrieves information from existing Microsoft 365 sources through Microsoft Graph.

Misconception 4: Copilot Ignores Compliance Controls

False.

Copilot respects:

Permissions
Sensitivity labels
DLP policies
Retention policies
Identity controls

Key Exam Takeaways

For the AB-900 exam, remember the following:

Microsoft 365 Copilot combines LLMs, Microsoft Graph, and Microsoft 365 data.
Microsoft Graph retrieves organizational information used to ground responses.
Copilot only accesses data a user is authorized to access.
Copilot honors existing permissions and access controls.
Authentication and authorization are enforced through Microsoft Entra ID.
SharePoint, OneDrive, Exchange, Teams, and other Microsoft 365 services provide Copilot’s data sources.
Sensitivity labels, DLP policies, and retention policies continue to apply.
Copilot does not bypass security boundaries.
Permission management is critical for successful Copilot deployments.
Grounding improves response quality by incorporating organizational data.

Practice Exam Questions

Question 1

What component connects Microsoft 365 Copilot to organizational data stored across Microsoft 365 services?

A. Microsoft Graph
B. Microsoft Defender XDR
C. Microsoft Intune
D. Azure Virtual Network

Answer: A

Explanation: Microsoft Graph retrieves organizational data and provides context that Copilot uses to generate responses.

Question 2

A user asks Copilot to summarize a document stored in SharePoint. What determines whether Copilot can access the document?

A. The user’s existing permissions to the document
B. Whether the document is larger than 100 MB
C. Whether Microsoft Defender is enabled
D. Whether the document was created in Word

Answer: A

Explanation: Copilot honors existing permissions and can only access content the user is already authorized to view.

Question 3

Which Microsoft 365 service is commonly used as a source of files that Copilot can reference?

A. Active Directory Domain Services
B. Hyper-V
C. SharePoint Online
D. DNS Manager

Answer: C

Explanation: SharePoint Online is a major repository for organizational documents and content accessed by Copilot.

Question 4

What is the purpose of grounding in Microsoft 365 Copilot?

A. Encrypting prompts before submission
B. Backing up user data automatically
C. Monitoring administrator activity
D. Enhancing AI responses with organizational data

Answer: D

Explanation: Grounding enriches AI-generated responses with relevant organizational information retrieved through Microsoft Graph.

Question 5

Which statement best describes how Copilot handles security permissions?

A. It grants temporary access to protected documents.
B. It bypasses SharePoint permissions when necessary.
C. It honors existing Microsoft 365 permissions.
D. It automatically makes all team content available.

Answer: C

Explanation: Copilot respects existing permissions and does not provide access to content users cannot already access.

Question 6

Which Microsoft service provides authentication and authorization for Copilot users?

A. Microsoft Entra ID
B. Microsoft Defender for Endpoint
C. Microsoft Purview Data Map
D. Microsoft Fabric

Answer: A

Explanation: Microsoft Entra ID authenticates users and enforces authorization decisions that determine accessible content.

Question 7

A company applies sensitivity labels to confidential documents. How does Copilot interact with those documents?

A. Copilot removes the labels before processing.
B. Copilot ignores label protections.
C. Copilot can share the documents with any employee.
D. Copilot continues to respect the protections enforced by the labels.

Answer: D

Explanation: Sensitivity labels remain effective and continue governing access to protected content.

Question 8

Which Microsoft 365 workload can provide meeting transcripts that Copilot may use when generating responses?

A. Microsoft Teams
B. Microsoft Project Server
C. Windows Server
D. Microsoft Endpoint Configuration Manager

Answer: A

Explanation: Teams meeting transcripts are one of the organizational data sources that Copilot can use when users have access.

Question 9

What happens when a user asks Copilot about information stored in a file they do not have permission to access?

A. Copilot grants temporary access.
B. Copilot can still summarize the file.
C. Copilot cannot access or expose the file’s contents.
D. Copilot sends an approval request automatically.

Answer: C

Explanation: Copilot enforces existing access controls and cannot retrieve information from content the user is not authorized to access.

Question 10

Why do organizations often review permissions before deploying Microsoft 365 Copilot?

A. Copilot requires every file to be reuploaded.
B. Overshared content may become more discoverable through AI-assisted interactions.
C. Copilot disables SharePoint security.
D. Microsoft Graph cannot function without permission reviews.

Answer: B

Explanation: Because Copilot honors existing permissions, organizations often review and reduce oversharing to ensure users only have access to appropriate information.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Security, Cybersecurity, Data Security, Microsoft Certification, security June 27, 2026

Understand features and capabilities of Microsoft Purview Information Protection, Microsoft Purview Data Loss Prevention (DLP), Microsoft Purview Insider Risk Management, Microsoft Purview Communication Compliance, Microsoft Purview Data Security Posture Management (DSPM) for AI, and Microsoft Purview Data Lifecycle Management (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Understand Microsoft Purview
      --> Understand features and capabilities of Microsoft Purview Information Protection, Microsoft Purview Data Loss Prevention (DLP), Microsoft Purview Insider Risk Management, Microsoft Purview Communication Compliance, Microsoft Purview Data Security Posture Management (DSPM) for AI, and Microsoft Purview Data Lifecycle Management

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

As organizations adopt Microsoft 365, Copilot, and AI-powered solutions, protecting sensitive information becomes increasingly important. Microsoft provides a unified compliance and governance platform called Microsoft Purview.

Microsoft Purview helps organizations:

Protect sensitive information.
Prevent accidental or intentional data loss.
Manage records and retention.
Detect insider risks.
Monitor communications.
Strengthen AI data governance.
Meet regulatory and compliance requirements.

For the AB-900 exam, you should understand the purpose and capabilities of the major Microsoft Purview solutions rather than detailed implementation steps.

What Is Microsoft Purview?

Microsoft Purview is Microsoft’s unified data governance, compliance, and risk management platform.

Purview enables organizations to:

Discover and classify data.
Protect sensitive information.
Govern information throughout its lifecycle.
Reduce insider threats.
Monitor AI-related risks.
Meet legal and regulatory obligations.

Purview works across:

Microsoft 365
Exchange Online
SharePoint Online
OneDrive
Teams
Microsoft Copilot
Power Platform
Endpoint devices
Third-party cloud services

Microsoft Purview Information Protection

Purpose

Microsoft Purview Information Protection (MIP) helps organizations classify and protect sensitive information.

It enables organizations to:

Identify sensitive data.
Apply sensitivity labels.
Encrypt content.
Control sharing permissions.
Track and monitor protected content.

Sensitivity Labels

Sensitivity labels classify content based on its importance.

Examples:

Public
General
Confidential
Highly Confidential

Labels can be applied to:

Emails
Word documents
Excel files
PowerPoint presentations
SharePoint sites
Teams
Microsoft 365 Groups

Protection Actions

Sensitivity labels can:

Encrypt Data

Only authorized users can open content.

Restrict Access

Prevent forwarding, printing, or copying.

Apply Visual Markings

Add:

Headers
Footers
Watermarks

Protect Copilot Data

Copilot respects existing permissions and sensitivity labels.

Benefits

Information Protection helps organizations:

Reduce accidental exposure.
Meet compliance requirements.
Maintain consistent classification.
Protect confidential information.

Microsoft Purview Data Loss Prevention (DLP)

Purpose

Data Loss Prevention (DLP) helps prevent sensitive information from being shared improperly.

DLP identifies sensitive information and automatically applies protection actions.

Examples of Sensitive Information

Credit card numbers
Social Security numbers
Passport numbers
Healthcare records
Financial information

DLP Actions

Policies can:

Block email transmission.
Prevent file sharing.
Warn users before sending data.
Generate alerts.
Create audit records.

Locations Protected by DLP

DLP policies can protect:

Exchange Online
SharePoint Online
OneDrive
Microsoft Teams
Endpoint devices

Example

A user attempts to email customer credit card information outside the company.

DLP can:

Detect the information.
Display a warning.
Block the message.

Benefits

DLP helps:

Prevent accidental leaks.
Support compliance requirements.
Educate users with policy tips.
Reduce organizational risk.

Microsoft Purview Insider Risk Management

Purpose

Insider Risk Management helps detect risky behavior from internal users.

Risks may be:

Accidental
Negligent
Malicious

Examples of Risky Activities

Downloading large amounts of files.
Sending confidential information externally.
Copying data to USB devices.
Unusual file access patterns.
Data theft before leaving the company.

Risk Indicators

The solution uses:

User activities
Behavioral signals
Microsoft 365 audit logs

Investigation Capabilities

Administrators can:

Review alerts.
Analyze activities.
Escalate incidents.
Document investigations.

Benefits

Insider Risk Management helps:

Reduce insider threats.
Detect suspicious behavior early.
Protect intellectual property.

Microsoft Purview Communication Compliance

Purpose

Communication Compliance helps organizations monitor communications for policy violations.

Content Sources

Communication Compliance can monitor:

Microsoft Teams chats
Emails
Copilot interactions
Other communication channels

Violations It Can Detect

Examples include:

Harassment
Threatening language
Offensive content
Inappropriate sharing
Regulatory violations

Review Process

Flagged communications are:

Detected automatically.
Reviewed by authorized reviewers.
Investigated when necessary.

Benefits

Communication Compliance helps:

Promote workplace safety.
Meet industry regulations.
Reduce legal exposure.
Enforce organizational policies.

Microsoft Purview Data Security Posture Management (DSPM) for AI

Purpose

DSPM for AI helps organizations understand and secure how AI systems interact with organizational data.

As AI adoption grows, organizations need visibility into:

What data AI tools can access.
Which users have access to sensitive information.
Potential AI-related risks.

DSPM for AI Capabilities

DSPM for AI helps organizations:

Discover AI Usage

Identify where AI tools are being used.

Assess Data Exposure

Understand whether sensitive data may be exposed.

Monitor Copilot Activity

Gain visibility into AI interactions.

Identify Oversharing Risks

Locate files with excessive permissions.

Strengthen AI Governance

Improve controls around AI usage.

Example

DSPM for AI may discover:

A SharePoint site containing confidential files.
Excessive permissions on the site.
Potential exposure to Copilot responses.

Administrators can then reduce permissions and improve security.

Benefits

DSPM for AI supports:

Responsible AI adoption.
Reduced oversharing risks.
Better governance of AI systems.

Microsoft Purview Data Lifecycle Management

Purpose

Data Lifecycle Management governs information throughout its lifecycle.

It ensures that information is:

Retained when required.
Deleted when no longer needed.
Managed according to regulations.

Retention Policies

Retention policies determine how long content should be kept.

Examples:

Content Type	Retention Period
HR records	7 years
Financial documents	10 years
General emails	3 years

Retention Labels

Labels can assign different retention periods to individual documents.

Example:

Contract documents retained for 10 years.
Project files retained for 5 years.

Automatic Deletion

When retention periods expire, content can be deleted automatically.

Benefits include:

Reduced storage costs.
Reduced legal risk.
Better compliance.

Records Management

Organizations can designate records that must not be altered or deleted before their retention period ends.

How These Purview Solutions Work Together

Solution	Primary Goal
Information Protection	Classify and protect content
DLP	Prevent data leakage
Insider Risk Management	Detect risky user behavior
Communication Compliance	Monitor communications
DSPM for AI	Secure AI data access
Data Lifecycle Management	Retain and dispose of data appropriately

Together, these capabilities provide a comprehensive governance framework for Microsoft 365 and Copilot.

Importance for Microsoft 365 Copilot

Copilot respects existing Microsoft 365 permissions and compliance controls.

Purview solutions help ensure:

Sensitive content is labeled.
Oversharing risks are minimized.
AI interactions remain compliant.
Records are retained appropriately.
Users do not accidentally expose confidential data.

Key Exam Points

Remember these AB-900 concepts:

Information Protection uses sensitivity labels to classify and protect content.
DLP prevents inappropriate sharing of sensitive data.
Insider Risk Management detects risky user behavior.
Communication Compliance monitors communications for policy violations.
DSPM for AI helps organizations govern AI usage and identify oversharing risks.
Data Lifecycle Management controls retention and deletion of information.
Microsoft Purview supports Microsoft 365, Copilot, and AI governance.

Practice Exam Questions

Question 1

Which Microsoft Purview solution primarily uses sensitivity labels to classify and protect content?

A. Communication Compliance
B. Data Lifecycle Management
C. Information Protection
D. Insider Risk Management

Correct Answer: C

Explanation: Microsoft Purview Information Protection uses sensitivity labels to classify and secure content.

Question 2

Which Microsoft Purview capability helps prevent users from emailing credit card numbers outside the organization?

A. Insider Risk Management
B. Communication Compliance
C. Data Loss Prevention (DLP)
D. Records Management

Correct Answer: C

Explanation: DLP detects sensitive information and can block or warn users before sharing it.

Question 3

Which solution is designed to identify potentially malicious or risky behavior by internal users?

A. Information Protection
B. Sensitivity Labels
C. Data Lifecycle Management
D. Insider Risk Management

Correct Answer: D

Explanation: Insider Risk Management focuses on identifying risky activities performed by users inside the organization.

Question 4

A company wants to monitor Teams messages for harassment and inappropriate language. Which Microsoft Purview solution should they use?

A. DLP
B. Communication Compliance
C. DSPM for AI
D. Information Protection

Correct Answer: B

Explanation: Communication Compliance analyzes communications for policy violations.

Question 5

What is the primary purpose of Microsoft Purview DSPM for AI?

A. Manage mailbox permissions
B. Secure and govern AI-related data exposure
C. Encrypt documents automatically
D. Replace Conditional Access

Correct Answer: B

Explanation: DSPM for AI provides visibility into AI usage and helps identify oversharing risks.

Question 6

Which Microsoft Purview capability determines how long information should be retained?

A. Insider Risk Management
B. Communication Compliance
C. Data Lifecycle Management
D. Information Protection

Correct Answer: C

Explanation: Data Lifecycle Management uses retention policies and labels to manage content over time.

Question 7

Which action can a sensitivity label perform?

A. Create Teams channels automatically
B. Synchronize users with Active Directory
C. Configure Conditional Access policies
D. Encrypt documents and restrict access

Correct Answer: D

Explanation: Sensitivity labels can apply encryption and restrict how information is used.

Question 8

Which Microsoft Purview solution helps identify oversharing risks that may affect Microsoft Copilot responses?

A. DSPM for AI
B. Communication Compliance
C. Data Lifecycle Management
D. Exchange Online Protection

Correct Answer: A

Explanation: DSPM for AI helps organizations understand how AI systems interact with organizational data and identify excessive permissions.

Question 9

A company must retain financial documents for ten years to meet regulatory requirements. Which capability addresses this need?

A. DLP
B. Insider Risk Management
C. Data Lifecycle Management
D. Communication Compliance

Correct Answer: C

Explanation: Retention policies and labels within Data Lifecycle Management ensure information is preserved for required periods.

Question 10

Which statement best describes the relationship between Microsoft Purview and Microsoft 365 Copilot?

A. Copilot ignores Purview policies.
B. Purview replaces Copilot permissions.
C. Copilot stores all data outside Microsoft 365.
D. Copilot works with existing Purview protections and permissions.

Correct Answer: D

Explanation: Microsoft 365 Copilot honors existing permissions, sensitivity labels, and compliance controls established through Microsoft Purview.

Go to the AB-900 Exam Prep Hub main page