AB-900 Data Protection Risks and SharePoint Oversharing: Purview Explorers, Alerts, DSPM for AI and SharePoint Advanced Management

Identifying data protection risks in Microsoft 365 means picking the Microsoft Purview or SharePoint tool whose job matches the question you're asking: how compliant are we, where is sensitive data, what did people do with it, who is risky, what did a policy catch, what are people doing with AI, where is a specific piece of content, and what is shared too widely. Both of the exam's skill groups on data protection risks and SharePoint oversharing come down to telling these tools apart.

Pairs worth separating are Data explorer vs activity explorer (current state vs history of actions), Content search vs audit search (the content itself vs records of what people did) and Compliance Manager vs Secure Score (regulatory controls vs security posture). What each Purview solution is belongs to the lesson on Microsoft Purview and Copilot data security; this lesson is about using them to find and respond to risk.

Microsoft Purview Compliance Manager measures how well your Microsoft 365 configuration meets regulations and standards, and tells you what to do next. It is the tool for requirements that combine a score, a named regulation (GDPR, ISO/IEC 27001, ISO/IEC 27701, NIST and many more) and assignable recommended steps backed by evidence.

• Assessments are how you track a regulation. You create one from a regulatory template; the template brings in the regulation's controls and the improvement actions that support them. A data protection baseline assessment is provided by default, and you add more alongside it.
• Improvement actions are the individual steps. Each one carries points toward the score, an assigned owner, an implementation status, a test status and an Evidence area for uploaded documentation. Some can be tested automatically from your tenant's configuration.
• Compliance score is a percentage that rises as actions are implemented and tested.

Compliance Manager uses the shared responsibility model. Microsoft implements and tests the controls for its own cloud services, and those count toward your score without any work from you. The Improvement actions page lists the actions your organization is responsible for completing.

Secure Score (in Microsoft Defender XDR, and Identity Secure Score in Entra ID) is the near-twin: it also gives a score and recommended actions, but it measures security posture, not progress against regulatory controls.

Data explorer shows where classified content sits today; activity explorer shows what people did with it recently. Both live under Information Protection in the Microsoft Purview portal.

Data explorer

Data explorer (formerly content explorer, which Microsoft now shows as the classic experience) is a snapshot inventory of items that carry a sensitive information type, a sensitivity label, a retention label or a trainable-classifier match. You start from a classification, such as the Credit Card Number type, see counts per location (Exchange mailboxes, SharePoint sites, OneDrive accounts) and drill down to the individual items. It's the natural first stop for "where is our sensitive data before Copilot rolls out?"

Because the item list itself can expose sensitive data, seeing items needs one of two dedicated role groups, which are separate rather than cumulative:

An admin role that opens the page can show counts without showing any items. The general rule: grant the narrowest role group that matches what the person must see, so someone who only needs an inventory of locations gets List viewer, and Content viewer is reserved for people who must read the items.

Activity explorer

Activity explorer is a history of actions taken on labeled and sensitive content: a sensitivity label applied, changed or removed, a file read, a DLP rule matched, and more. You filter by activity type, user, label, location and date, and each event shows who did it, to which item and when. It answers questions such as "which users removed a label from files in the Finance site this month?" or "how often did a DLP rule match on OneDrive?"

Two limits matter. Activity explorer draws its data from the unified audit log, so it isn't real time, and it reports on about the last 30 days only. For an older event, search the audit log itself in Microsoft Purview Audit: its default retention (180 days for Audit (Standard)) is much longer than activity explorer's window.

Insider Risk Management turns sequences of user activity, such as mass downloads before a resignation date, into risk alerts that analysts triage. Policies built from templates (for example, data theft by departing users) score activity and raise alerts with a severity.

Triage is a two-way decision after reviewing the alert's activity:

• Confirm the alert and create a case (or add it to an existing case) when the risk is real and needs investigation. A case brings the user's activities and related content together, and investigators can work it through, for example by sending the user a notice or escalating to an eDiscovery (Premium) case.
• Dismiss the alert when the activity is explained and harmless, such as a documented, authorized data migration that explains the volume of activity.

Because investigations concern colleagues, usernames are pseudonymized by default: analysts see generated identifiers instead of names until an admin changes the privacy setting. That protects privacy and reduces bias. Don't confuse insider risk alert triage (confirm or dismiss) with Communication Compliance remediation actions such as Tag as or Escalate for investigation, which act on individual messages. Both solutions can lead to an eDiscovery (Premium) case, but in Insider Risk Management that happens later, from a confirmed case, not as an alert-triage choice.

A DLP alert tells you that a DLP policy rule matched an action, and you respond by reviewing its event details and updating its status. Microsoft recommends managing DLP alerts in the Microsoft Defender portal (Defender XDR), where they are correlated into incidents with alerts from email, endpoint and identity tools. The Microsoft Purview portal also has a DLP alerts page, and it's where DLP policies themselves are created and edited.

The alert's event details are where the investigation happens. They show the policy and rule that matched, the sensitive information types and counts, the user, the location or workload, the action taken, and, if the rule allowed it, whether the user overrode a policy tip and the business justification they gave. That policy-tip context exists only in the alert: searching for the content afterwards finds the item but not the user's decision about the tip.

Severity, incident report emails and policy tips don't reduce alert volume; they're per-match notifications or labels. The setting that changes how many alerts are raised is the alert type itself: aggregated alerting trades per-match visibility for fewer, volume-based alerts.

Communication Compliance flags messages in Teams, email and Copilot interactions that match a policy (threats, harassment, sharing sensitive data, regulatory conduct) and puts them in a review queue. Reviewers work from the Pending tab, and closed items move to Resolved. Each match is handled with one of these remediation actions:

Only Remove message in Teams changes what other people see; every other action leaves the message where it is. And only Escalate for investigation opens a legal case; plain Escalate just changes the reviewer.

Data Security Posture Management (DSPM) for AI is the Purview hub for seeing what people do with Microsoft 365 Copilot, agents and third-party AI apps, and what sensitive data is involved. Its reports and its own activity explorer show AI interactions and AI website visits, the users and apps involved, and sensitive information types found in prompts and responses. Recommendations create supporting policies in one click (DLP, Insider Risk Management, Communication Compliance and collection policies). Microsoft now labels this experience DSPM for AI (classic) beside the newer unified DSPM; the exam guide still uses the name DSPM for AI.

What appears depends on prerequisites:

• Microsoft Purview Audit turned on for the tenant. The reports are built from audit records of Copilot and AI interactions, so Copilot and AI activity appears only once auditing is on.
• For third-party AI websites, the activity happens in the browser on a device, so devices must be onboarded to Microsoft Purview and, in Chrome, the Microsoft Purview browser extension installed (Edge is integrated through an Edge policy instead).

DSPM for AI tells you what data people put into AI apps. Microsoft Defender for Cloud Apps discovery is the near-twin that tells you which apps are in use; it doesn't show what was typed.

Data risk assessments

A data risk assessment finds potentially overshared content that Copilot could surface, such as items shared with anyone or sensitive data in widely accessible sites. A default assessment runs automatically, with no setup, every week on the top 100 SharePoint sites by usage. Because it chooses sites by usage, a quiet but risky site can be left out; for that, create a custom assessment scoped to the sites (or users) you choose. Each assessment's results come with remediation options, such as restricting access to the site, hiding it with Restricted Content Discovery, auto-labeling sensitive files or starting a site access review.

Content search finds the actual emails, chats and documents that match keywords and conditions, so you can preview them and export them. It searches Exchange mailboxes (where Teams chat messages are stored), SharePoint sites, OneDrive accounts and Teams content, with conditions such as sender, date range, participants and file type. The classic Content search page was retired in 2025; searches now run in the new Microsoft Purview eDiscovery experience.

Know what Content search is not:

• Audit log search returns records of what people did (who opened, shared or relabeled a file), not the content.
• Data explorer lists already-classified items; it doesn't run free keyword searches.
• Exchange message trace follows messages through mail flow (sender, recipient, delivery status); it doesn't read message bodies or touch OneDrive.

Content search can expose any mailbox or site in the tenant, so it's controlled by eDiscovery permissions rather than general admin roles. The eDiscovery Manager role group grants search, preview and export without broader admin rights, making it the least-privilege choice for a paralegal or investigator.

Oversharing is content shared more widely than it should be. Microsoft 365 Copilot only shows users what they can already open, so oversharing is the main data risk to fix before Copilot rollout: Copilot makes overshared files far easier to find. The two tools built to find it are SharePoint data access governance (DAG) reports and DSPM for AI data risk assessments. Compliance Manager, Insider Risk Management, Communication Compliance and Content search answer other questions.

DAG reports are run from the SharePoint admin center > Reports > Data access governance, where they're grouped into snapshot and activity reports:

Snapshot reports describe current permissions and make a baseline; activity reports describe recent sharing and help you watch new risk. Microsoft recommends starting with the snapshot reports. When choosing one, match the report's time scope to the question: activity reports only see sharing from the last 28 days, while snapshot reports cover access however old it is.

SharePoint Advanced Management (SAM) is a set of SharePoint governance features for finding and fixing oversharing and managing site sprawl. It's included when the tenant has at least one Microsoft 365 Copilot license, or it can be bought separately. DAG reports themselves belong to SAM (Microsoft 365 E5 admins without SAM can still see limited DAG activity reporting, without the snapshot reports or remediation); the other features fall into three groups.

Hand findings to site owners: site access reviews

A site access review is started from a DAG report and sends each selected site's owners an email about the specific issue. Owners, who know who should have access, fix permissions (for example through Manage access) and mark the review complete; the admin tracks status and comments on the My review requests tab without seeing file-level changes. Nothing is removed automatically, and a review stays pending until the owner finishes. The web view starts reviews for up to 100 sites at a time (use PowerShell for more), and reviews cover SharePoint sites only, not OneDrive accounts.

Don't confuse them with Microsoft Entra ID access reviews (Identity Governance), which review membership of groups and access to apps and can route the decision to users' managers. A SharePoint site access review is about one site's permissions after a DAG finding, and it always goes to that site's owners.

Restrict who can reach or find content

Restricted access control needs both group membership and a site permission: adding someone to the control group lets them pass the restriction, but they still need permission on the site. Restricted Content Discovery changes nothing about permissions and leaves content in the index, so eDiscovery and other Purview features still find it, and Copilot still works on a document a user already has open. It also works on content regardless of labels: a Copilot DLP policy keys on sensitivity labels, so it can't protect files that aren't labeled yet, which is why Restricted Content Discovery is the site-level stopgap while labeling catches up.

Control what permitted users can do, and keep sites tidy

• Block download policy: per-site, browser-only access with no download, print or sync (set with Set-SPOSite -BlockDownloadPolicy), with optional exemptions for site owners or chosen groups.
• Conditional Access with an authentication context: publish an authentication context in Microsoft Entra ID, target it with a Conditional Access policy (for example MFA or terms of use for guests), and apply the context to one site, with Set-SPOSite or through a sensitivity label. Other sites keep their current sign-in rules, unlike a policy aimed at the whole SharePoint Online app.
• Inactive site policy: finds sites with no activity for a set period, emails their owners to confirm they're still needed, and makes unconfirmed sites read-only or archives them with Microsoft 365 Archive.
• Site ownership policy: finds sites without enough owners and asks for new ones; it checks owner counts, not activity.
• Change history report: shows site property and setting changes over up to the last 180 days.