Activity Explorer & Content Search
Activity Explorer shows what users are doing with sensitive data. Content search finds specific items across mailboxes, sites, and public folders. Two essential investigation surfaces for information security.
Two investigation surfaces
Activity Explorer is like watching live security camera feeds — you see what people are DOING with your data right now. Who changed a label? Who triggered a DLP policy? Who downloaded sensitive files?
Content search is like sending a search dog into every room in the building — it finds specific items (emails, documents, Teams messages) across your entire M365 tenant based on keywords, dates, senders, or locations.
Activity Explorer shows actions. Content search finds things.
Activity Explorer
What it shows
| Activity Type | Source | Examples |
|---|---|---|
| Label activities | Sensitivity and retention labels | Label applied, label changed, label removed, justification provided |
| DLP activities | DLP policies | DLP rule matched, DLP override, DLP false positive reported |
| Endpoint activities | Endpoint DLP | File copied to USB, file printed, file uploaded, app access blocked |
| Auto-labeling | Auto-labeling policies | Label auto-applied (client-side or service-side) |
Filters and analysis
| Filter | What It Narrows |
|---|---|
| Activity type | Focus on specific actions (e.g., only DLP matches) |
| Date range | Narrow to specific time period |
| User | Activities by a specific user |
| Location | SharePoint, Exchange, OneDrive, or endpoints |
| Label | Activities involving a specific sensitivity or retention label |
| Policy | Activities triggered by a specific DLP policy |
Common investigation patterns
| Pattern | What to Look For | Action |
|---|---|---|
| Label downgrade spike | Multiple users downgrading labels in a short period | Check if a policy is too restrictive or users are circumventing |
| DLP override pattern | Same user repeatedly overriding DLP blocks | Review the user’s justifications — legitimate need or security bypass? |
| Endpoint exfiltration | USB copies or cloud uploads of sensitive data | Correlate with Insider Risk alerts |
| Auto-labeling gap | Content in scope not being labelled | Check auto-labeling policy mode (simulation vs active) |
Content search
Content search finds specific items across your M365 tenant. It is a separate tool from audit log search.
Where Content search looks
| Location | What It Searches |
|---|---|
| Exchange mailboxes | Emails, calendar items, contacts, tasks |
| SharePoint sites | Documents, list items, pages |
| OneDrive accounts | Personal cloud files |
| Microsoft 365 Groups | Group mailboxes and SharePoint content |
| Exchange public folders | Public folder content |
Creating a Content search
| Step | What You Configure |
|---|---|
| 1. Name | Search name and description |
| 2. Locations | All locations, specific mailboxes, specific sites, or specific groups |
| 3. Search conditions | Keywords, date range, sender/recipients, file types, SIT matches |
| 4. Run | Execute the search |
| 5. Preview | View matched items before exporting |
| 6. Export | Download results for analysis (requires eDiscovery Export tool) |
Search query syntax
| Operator | Example | What It Finds |
|---|---|---|
| AND | confidential AND merger | Items containing both words |
| OR | confidential OR restricted | Items containing either word |
| NOT | budget NOT draft | Items with “budget” but not “draft” |
| Phrases | "quarterly earnings" | Exact phrase match |
| Wildcards | financ* | Matches financial, finance, financing, etc. |
| Date range | sent:2026-01-01..2026-03-31 | Items sent in Q1 2026 |
| Sender | from:john@meridian.com | Items from a specific sender |
| Feature | Activity Explorer | Content Search |
|---|---|---|
| Purpose | See what users are DOING with data | FIND specific items across M365 |
| Data shown | Activities: label changes, DLP matches, endpoint events | Content: emails, documents, Teams messages |
| Best for | Monitoring trends, investigating behaviour | Finding specific items for review, investigation, or export |
| Output | Activity timeline with filters | List of matching items, preview, export |
| Export | Activity reports (CSV) | Full content export (emails, documents) |
| Portal location | Purview → Data classification → Activity explorer | Purview → Content search |
Scenario: Zara investigates a data sharing pattern
Atlas Global’s security team notices unusual external sharing in Activity Explorer — a spike in “DLP override” activities from the marketing department over the past week.
Zara’s investigation:
- Activity Explorer: Filter by activity “DLP override” + date range “last 7 days” + location “Marketing SharePoint”
- Findings: 45 overrides by 3 users — all sharing client presentations externally with justification “client meeting”
- Content search: Search the Marketing SharePoint for documents shared externally in the last 7 days
- Results: 60 documents found — most are legitimate client decks, but 3 contain internal pricing data that should not have been shared
- Action: Escalate the 3 pricing documents to the compliance team. Adjust the DLP policy to block pricing data without override.
Priya at Meridian Financial needs to find all emails containing client account numbers sent to external recipients by the trading team in the last 90 days. Which tool should she use?
🎬 Video coming soon
Next up: Alert Response: Purview, XDR & Cloud Apps — when alerts fire across Purview, Defender XDR, and Cloud Apps, respond effectively from the right console.