5.5. Reflection Checkpoint

Key Takeaways

• The Service Trust Portal documents Microsoft's own compliance evidence; Compliance Manager manages the customer's own compliance workflow — don't confuse the two directions of accountability.
• Compliance score is a risk-weighted number generated from Compliance Manager's tracked improvement actions, not a separately sourced metric.
• Classification (find sensitive data), sensitivity labels (protect it), and retention labels (govern how long it's kept) are three distinct capabilities that commonly apply to the very same document simultaneously.
• DLP intervenes in real time at the moment of a risky action (like sending an email); it is preventive, not just a retrospective report.
• Retention policies apply broadly to a location; retention labels apply granularly to individual items and generally take precedence when both exist.
• Insider risk management flags risky internal behavior; eDiscovery finds and preserves content for legal cases; Audit tracks user/admin activity — three different investigative questions, often used together.

Connecting Forward

You've now covered all four weighted domains. Phase 6 shifts from learning to test-taking strategy and rapid review, Phase 7 consolidates every term into a single searchable glossary, and Phase 8 wraps up with a confidence checklist before you sit the exam.

Self-Check Questions

• Why can a single document simultaneously carry a sensitivity label, a retention label, and be subject to a DLP policy, without those three capabilities conflicting?
• If Compliance Manager assigns an improvement action to Microsoft rather than the customer, does completing it still raise the customer's compliance score? Why might it matter either way?
• An investigator needs to know both what a leaked document said and who accessed it. Which two Purview capabilities does that require, and what does each contribute?