Monitoring endpoint activities

There are several built-in reports available for DLP in the compliance center (https://compliance.microsoft.com), which will be covered in Chapter 9, Managing and Monitoring Data Loss Prevention Policies and Activities.

To monitor the endpoint activities, we will instead use the activity explorer in the compliance center. Navigate to either one of the following places:

• Data classification | Activity explorer
• Data loss prevention | Activity explorer

Using the activity explorer, we can see exactly what our onboarded devices are doing when it comes to creating items, editing items, moving items, and/or sharing them. The information is collected from the Microsoft 365 unified audit logs, transformed, and made available in the activity explorer interface:

Figure 8.20 – The activity explorer shows us all activities performed on endpoints

You can use the activity explorer to drill down into specific events...