5.3.2. Content Explorer and Activity Explorer
💡 First Principle: Once content is classified, an organization needs visibility into both where that sensitive content actually lives (Content explorer) and what's happening to it over time — views, edits, label changes (Activity explorer) — turning classification from a one-time scan into an ongoing, observable picture of data risk.
Content explorer answers "show me every document currently classified as containing financial account numbers, and where they are." Activity explorer answers "show me every time a sensitivity label was downgraded or removed in the last 30 days" — the former is a snapshot of current state, the latter is a history of change over time.
⚠️ Exam Trap: Content explorer surfaces where sensitive content currently is; Activity explorer surfaces what actions have happened to labeled content over time — a question about tracking label removal activity is testing Activity explorer, not Content explorer.
Reflection Question: A compliance officer wants to know whether anyone has recently removed a "Highly Confidential" sensitivity label from documents. Which tool answers that, and why wouldn't Content explorer alone be sufficient?