12.2 Monitor Endpoint Activities

12.2 Monitor Endpoint Activities

Quick Answer: After devices are onboarded, Endpoint DLP telemetry shows up in three different places. Activity explorer is a 30-day, not real-time view built from the Microsoft 365 unified audit log. Audit search is the source of those records and is how you independently confirm an activity. The Devices list (Settings > Device onboarding > Devices) is the health surface: Last seen, Configuration status, and Policy sync status. Policy-match alerts go to the DLP Alerts dashboard (30 days in Purview, six months in Microsoft Defender). JIT holds are Activity explorer events, not alerts.

Why monitoring is a separate SC-401 skill

Configuring Endpoint DLP and JIT does not prove they are working. SC-401 expects you to pick the right console for the question:

• A user copied a labeled file to USB an hour ago—start in Activity explorer, and if the row is missing, Audit search.
• A policy never fires on a laptop—open the Devices list and check Last seen, Configuration status, and Policy sync status.
• An investigator needs to triage a policy match—use the DLP Alerts dashboard (or Defender, where the same alert lasts longer).
• Leadership asks whether laptops are ready for JIT—use Settings > Device onboarding > Device report, not Activity explorer.

Mixing those surfaces is a common exam distractor. Activity explorer does not show whether a device received the latest policy. The Devices list does not show DLPRuleMatch contextual text. Alerts do not list every audited copy.

Activity explorer: 30-day activity view

Activity explorer lives in the Microsoft Purview portal (Information Protection / data classification, and as a tab on the DLP page). Microsoft documents that:

• Data comes from the Microsoft 365 unified audit logs, then is transformed for the Activity explorer UI.
• The UI reports up to 30 days of data.
• It is not a real-time view. For core services (Exchange, SharePoint, OneDrive, and Teams), allow 60 to 90 minutes. Other services can take longer; Microsoft does not guarantee a specific availability time.
• Devices report endpoint activities only while they are online. An offline device backfills after it reconnects.
• Once a device is onboarded, audited activities flow into Activity explorer even before you deploy any DLP policy that includes Devices.

Preconfigured filter sets that matter for Endpoint DLP include Endpoint DLP activities, Egress activities, Files containing sensitive info types, DLP policies that detected activities, and DLP policy rules that detected activities. You can also filter on activity type, location, user, device name, client IP, sensitivity label, and whether the item is protected. Filter dropdown values are generated from the first 500 records for performance; some values may be missing from the dropdown even if they exist in the data. For endpoint events, Activity explorer surfaces the most restrictive DLP rule, and filters operate on that rule.

Example device activities Microsoft lists include deletion, creation, copy to clipboard, modify, read, print, rename, copy to network share, and access by an unallowed app.

When a DLP rule matches, look at two adjacent rows:

• The user activity (for example CopyToClipboard or CloudEgress) carries policy context.
• The DLPRuleMatch event carries the contextual summary—the text surrounding the matched content, such as digits around a credit card number.

For that contextual summary on Windows endpoints, Microsoft requires KB5016688 (Windows 10) or KB5016691 (Windows 11) or later, and advanced classification must be enabled. JIT events are different: they show JIT triggered = true and do not raise DLPRuleMatch or an alert.

Activity explorer is not where you prove a device is healthy. If a recent copy is missing, first confirm it is inside the 30-day window, wait for audit-log latency, confirm the device is online (or has reconnected), then search Audit. An empty view right after you publish a policy usually means the pipeline has not caught up, not that the policy failed.

Purview Audit versus Activity explorer

All DLP monitored activities are recorded to the Microsoft 365 audit log by default and routed to Activity explorer. That sentence is the relationship you should memorize:

Use Audit when Activity explorer is empty, when you need a time range Activity explorer will not show, or when you must prove an event exists in the unified log. Use Activity explorer when you need DLP-oriented filters (Endpoint DLP activities, egress, policy/rule matches) and the rich file metadata Endpoint DLP attaches to those events.

Devices list, Last seen, and policy sync

Open Settings (gear) > Device onboarding > Devices. Select a device to open the details pane.

Configuration status and Policy sync status each use three values:

Last seen is the most recent time the device was determined to be online. Microsoft's troubleshooting note is blunt: devices must be online for the policy update to happen. If status is stuck, check Last seen before you recreate policies.

Other attributes on the device details pane include Last policy sync time, OS, Defender engine version, Defender Mocamp (client) version, MDATP device ID, Valid user (the signed-in user has a corresponding Microsoft Entra ID account and is in scope of a Devices-targeted DLP policy), Sensitive Data Activity for the last 30 days, whether advanced classification bandwidth was exceeded in the past 24 hours, and Endpoint DLP status (enabled or disabled).

The same DLP device fields are available in Microsoft Defender Advanced hunting on the DeviceInfo table in the DlpInfo JSON column (IsDlpConfigurationValid, IsDlpEnabled, HasDlpValidUpn, and related properties). Use hunting when you need fleet-wide queries instead of clicking one device at a time.

For Windows servers, onboarded servers do not show Endpoint DLP events in Activity explorer until you Enable Endpoint DLP for Windows Servers in Endpoint settings.

Device health report and Last seen buckets

Settings > Device onboarding > Device report is the fleet dashboard. It uses devices that reported in the past 30 days and updates hourly. Visualizations include:

• Device onboarding — coverage and configuration issues.
• Device readiness to receive policy updates — offline during the past day, outdated Microsoft Defender Antivirus, or configuration issues (these are risk indicators, not proof a specific update failed).
• Last time devices were seen online — non-cumulative buckets for the last 24 hours, 3 days, 7 days, and 30 days. Each device is counted once in the most recent applicable bucket.
• Device readiness for feature — currently Just-in-time protection and Paste to supported browsers.

Use this report to answer are we ready to turn on JIT, not to investigate a single USB copy.

DLP Alerts dashboard

The DLP Alerts page in Purview is for policy matches that generate alerts, not for every audited activity. You view alerts, events, and metadata; set investigation status; and track resolution. Alerts are also routed to the Microsoft Defender portal, where you can do the same work plus additional Defender XDR investigation. Microsoft publishes two retention numbers:

• Purview DLP alerts dashboard: 30 days
• Microsoft Defender portal: six months

Administrative-unit-restricted admins see only their unit's alerts. JIT in-progress and JIT block events are not alerts—do not expect them on this dashboard. When an endpoint policy match does alert, the event details can include rich device metadata (file hashes, device name, application, removable-media manufacturer/model/serial for USB copies).

Always audit and when events appear without a policy

Always audit file activity for devices is an Endpoint DLP setting. By default, after onboarding, the service audits activity for Office, PDF, and CSV files. You can review that activity in Activity explorer even if the device is not targeted by any policy. The setting also audits, when no DLP rule matched: File Created, File Modified, File Renamed, File created on removable media, and File created on network share.

Turn Always audit off if you want those Office/PDF/CSV activities audited only when onboarded devices are included in an active policy. Leave it on during early rollout so you can see baseline file movement before you publish blocking rules.

Microsoft also documents a second layer: some Office, PDF, CSV, and archive extensions can be audited regardless of a policy match on Windows and (with a shorter extension list) on macOS. Image formats such as .jpg and .png can be audited when OCR is enabled. Unsupported types such as .exe, .dll, and .sys are not monitored—do not invent coverage for them.

Common activities you can monitor or restrict

Endpoint DLP can audit and, for most egress channels, restrict these activities on sensitive items stored on Windows 10/11 and current macOS devices:

If data is never saved to a local file (for example Word saves directly to USB), Endpoint DLP cannot scan or block that path. That is a monitoring gap, not a misconfigured Activity explorer filter.

While policies already on an offline device still enforce on already-classified files, enforcement events do not appear in Activity explorer until the device is back online. The Devices list shows that an offline device is out of sync with server-side policies.

Exam scenarios

• Copied to USB, no alert: Check Always audit and Activity explorer first. Alerts require a rule configured to alert; audit events do not always become alerts.
• Policy never fires: Devices list Last seen and Policy sync status, then confirm both user and device are in the policy scope.
• JIT toast, no alert: Expected. Look for JIT triggered = true in Activity explorer.
• Need 90 days of alerts: Use Microsoft Defender, not the Purview DLP Alerts dashboard's 30-day window.
• Need last week's copies but Activity explorer is empty: Confirm 30-day window and latency, then Audit search; if the laptop was offline, wait for backfill.

Official resources

• Learn about Endpoint data loss prevention
• Get started with Activity explorer
• Troubleshooting endpoint DLP configuration and policy sync
• Monitor Endpoint DLP device health
• Get started with the DLP Alerts dashboard