Choose the evidence object
An investigation can require a history of supported operations, responsive document/message content, or correlation of potential insider-risk signals. Audit, eDiscovery and Insider Risk Management address these different needs. They can contribute to the same investigation, so product association alone does not decide a question. Write the evidence object first. “Who performed this recorded activity during this period?” is different from “Which content responds to this case?” and from “Which policy-defined signals warrant risk triage?”
Activity records and case content
Purview Audit records user/admin operations across supported services and supports searches by activity, user and date. eDiscovery identifies and manages content for investigations, including cases with searches, preservation holds and export capabilities. The current eDiscovery experience is the source for this lesson; retired classic guidance is not generalized into present feature availability. Content discovery and activity history can corroborate different aspects of a case, but neither automatically supplies the other’s complete evidence object.
Potential risk requires judgment
Insider Risk Management correlates signals of potentially malicious or inadvertent insider activities, with policies, investigation and privacy controls. Potential risk is not proof of intent or wrongdoing. A user activity query may supply evidence, but that query alone is not the full policy-based correlation and triage workflow. Likewise, a risk case does not by itself answer every legal or personnel question. Preserve the difference between a signal, an investigated finding and a decision requiring qualified human authority.
Worked example
Fictional teaching case: a community laboratory asks two questions about a past project. First, which recorded account performed a supported operation during a named week? Second, which messages and files should be identified and preserved as responsive content for an investigation? Match the first to Audit search and the second to an eDiscovery case workflow. The same project name does not merge the evidence requests. If a file appears in a content search, it is not thereby a record that a particular account performed every operation on it; the activity evidence must be evaluated separately.
Transfer check
Now a fictional review team wants policy-defined correlation and triage of potential insider-risk signals, with privacy controls, rather than a chronological list of one account’s operations. Which capability is the closer fit? Check basis: Insider Risk Management. Audit records can contribute supporting evidence, and eDiscovery may support later content review, but neither is the named risk-policy correlation workflow. The answer identifies a capability; it does not justify monitoring actual people, establish misconduct or determine legal guilt.
Check scope and preserve uncertainty
State which evidence is available, what remains missing and which capability fits the current request. Do not promise complete logs, universal preservation, a particular retention duration, legal admissibility or a licensed feature without evidence. These original fictional cases create no scans, holds, exports or tenant resources. Qualified educator review and learner trials remain pending; formal release stays on HOLD until the separate publication gates are satisfied.
Try it, then explain it.
Complete a short set without looking at the example. After each answer, explain which evidence or rule supports your decision and why the alternatives do not fit.
Sources & authorship
Original OpenExam explanations and examples. References support the concepts; they are not the source of copied questions. Independent educator review is pending.
Learn about auditing solutions in Microsoft Purview | Microsoft LearnMicrosoft Purview Compliance Manager | Microsoft LearnLearn about data loss prevention | Microsoft LearnLearn about eDiscovery | Microsoft LearnLearn about Insider Risk Management | Microsoft Learn