Describe the capabilities of Microsoft compliance solutions
Purview Insider Risk, eDiscovery, and Audit
CoreRecognize risk indicators, legal discovery workflows, and searchable activity records.
Aligned to the SC-900 skills measured as of July 28, 2026; product behavior verified September 10, 2026.
Why this matters
Compliance teams need different capabilities to identify potentially risky internal activity, respond to legal matters, and reconstruct who performed actions.
Must Know
- Microsoft Purview Insider Risk Management correlates signals to identify potentially risky user activity while providing privacy and workflow controls for investigation.
- Insider Risk Management uses policies, indicators, alerts, and cases; an alert is a signal for evaluation, not proof of malicious intent.
- Microsoft Purview eDiscovery supports identifying, preserving, collecting, reviewing, analyzing, and exporting content relevant to investigations and legal matters.
- Microsoft Purview Audit records and exposes searchable user and administrator activities across supported services.
- Audit supplies activity evidence; it does not by itself preserve all case content or decide whether conduct was malicious.
Compare and Distinguish
- Insider Risk Management vs Audit: correlate signals into risk workflows versus search recorded activities.
- eDiscovery vs Audit: manage content and custodians for a matter versus investigate activity records.
- Alert vs case: a surfaced signal requiring evaluation versus the organized investigation workflow.
- eDiscovery hold vs retention policy: preserve content for a particular matter versus govern lifecycle broadly.
Scenario examples
- A policy surfaces unusual data movement for privacy-aware investigation in an insider-risk case.
- Legal staff preserve a custodian's content and later collect and review it with eDiscovery.
- An investigator searches Audit to determine which administrator changed a setting.
Exam traps
- An insider-risk alert does not prove wrongdoing.
- Audit logging is not the same as eDiscovery preservation and review.
- eDiscovery is not a general threat-detection SIEM.
- Retention and legal hold can both preserve data but serve different governance contexts.
Key takeaways
- Use Insider Risk Management for potentially risky internal activity workflows.
- Use eDiscovery for legal and investigation content workflows.
- Use Audit to search recorded activities.
- Treat signals as evidence to evaluate, not automatic verdicts.
Ready for the quiz?
- Which solution preserves and reviews content for a legal matter?
- Which solution answers who changed a setting?
- Why is an insider-risk alert not a conclusion?
Related objectives
- D4.4.S1 — Describe insider risk management
- D4.4.S2 — Describe eDiscovery solutions in Microsoft Purview
- D4.4.S3 — Describe audit solutions in Microsoft Purview