Question

A departing employee is suspected of exfiltrating confidential project files. Your legal team asks you to identify every Teams message, SharePoint file, and email the employee sent in the last 30 days that references the project codename "Aurora," and to preserve those items so they cannot be altered or deleted while the investigation proceeds. You must accomplish both goals using Microsoft Purview. Which combination of actions should you take?

Accepted Answer

Create a Content Search scoped to the user across Exchange, SharePoint, and Teams with the keyword "Aurora," then create an eDiscovery (Premium) case and apply a hold to the same locations.

Answer

Run a Purview Audit (Premium) search filtered by the user and the keyword "Aurora," then enable Customer Lockbox on the affected mailboxes.

Answer

Configure a data loss prevention (DLP) policy that blocks any content containing "Aurora," then export the DLP policy match reports for the legal team.

Answer

Create an Insider Risk Management policy targeting the user, then apply a retention label to all SharePoint sites the user accessed.