MS-102 · Domain 4 of 4

MS-102 Domain 4: Manage compliance by using Microsoft Purview

Protecting and governing Microsoft 365 data with Microsoft Purview: custom sensitive information types, retention, sensitivity labels, label monitoring, and data loss prevention across workloads, Copilot and devices.

Exam weight
10–15%
Official functional groups
2
Estimated questions estimate
~6
Suggested study time estimate
8–11 hrs

About 11 min read Reviewed October 2026

Overview

Domain 4 is the smallest MS-102 skill area, but it is dense. Microsoft lists two functional groups with seven bullet objectives. The information protection and lifecycle group covers custom sensitive information types built from keywords, keyword lists or regular expressions, retention labels and label policies, retention policies, sensitivity labels and label policies, and monitoring label use with Content explorer, Activity explorer and label reports.

The data loss prevention group covers DLP policies for Exchange Online, SharePoint Online, OneDrive, Teams, Power BI and Microsoft 365 Copilot, Endpoint DLP on onboarded Windows and macOS devices, and reviewing DLP alerts, events and reports. The exam tests the administrator who configures these features, not the compliance officer who designs a full governance program.

How it's tested

Compliance questions describe data that must be found, kept, protected or kept from leaving the organization. You choose between sensitive information types, retention labels or policies, sensitivity labels, and DLP policies or locations, and you identify which explorer or report shows what happened.

  • Detect custom data

    An internal employee or project number must be detected, and you build a sensitive information type from a regular expression with supporting keywords.

  • Keep or delete

    Content must be kept for a period or deleted afterward, and you pick a retention policy for whole locations or a label for specific items.

  • Stop leakage

    Sensitive data must not leave by email, sharing, USB or Copilot responses, and you choose the DLP location, condition and action.

Reasoning it through

A legal team needs individual contracts kept for seven years and declared as records, while general mailbox content follows a three-year rule. A retention policy applied to all mailboxes handles the three-year baseline. Contracts need a retention label that marks items as records, published to users or auto-applied. Because explicit item-level retention beats implicit container retention, the label's longer period governs those contracts.

Functional groups 2

Official functional groups from the Microsoft outline, in outline order.

4.1 Implement Microsoft Purview information protection and data lifecycle managementCustom sensitive information types, retention, sensitivity labels and label monitoring.
What it means
This group covers implementing sensitive information types with keywords, keyword lists or regular expressions, implementing retention labels, retention label policies and retention policies, implementing sensitivity labels and their policies, and monitoring label usage with Content explorer, Activity explorer and label reports.
What to understand
A custom sensitive information type has a primary element such as a regular expression or keyword list, optional supporting elements within a proximity window, and high, medium or low confidence patterns. Retention policies apply to whole locations such as mailboxes or sites, while retention labels apply to items and can be published or auto-applied and can declare records. The principles of retention say retention wins over deletion, the longest retention period wins, explicit labels beat implicit policies, and the shortest deletion period wins. Sensitivity labels apply encryption, headers, footers and watermarks, and can also scope to groups and sites; label policies publish them with options such as a default or mandatory label. Content explorer shows where labeled or sensitive items sit, and Activity explorer shows label actions over time.
How it shows up
Expect a custom SIT design, a retention conflict to resolve, a label policy setting, or the right explorer for a monitoring task.
Common confusion
Using a sensitivity label to keep content for years, or a retention label to encrypt it.
4.2 Implement Microsoft Purview data loss prevention (DLP)DLP policies across workloads and Copilot, Endpoint DLP, and DLP alerts and reports.
What it means
This group covers configuring DLP policies for Microsoft 365 workloads including Exchange Online, SharePoint Online, OneDrive, Teams, Power BI and Microsoft 365 Copilot, configuring Endpoint DLP, and reviewing DLP alerts, events and reports.
What to understand
A DLP policy combines locations, conditions such as sensitive information types or sensitivity labels, and actions such as blocking, allowing override with justification, showing policy tips or notifying users. New policies can run in simulation mode first to measure impact. The Microsoft 365 Copilot location can stop Copilot from summarizing or using items with chosen sensitivity labels. Endpoint DLP applies to Windows and macOS devices onboarded through the Defender for Endpoint process and can audit or block copying to USB, printing, uploading to restricted cloud domains, or pasting to browsers. Alerts appear in the Purview DLP alerts dashboard and in Defender XDR, and Activity explorer lists matched events.
How it shows up
Expect a location choice, an action or override setting, an Endpoint DLP restriction, or where to review a DLP match.
Common confusion
Thinking Endpoint DLP needs a separate agent; devices are onboarded with the same process used for Defender for Endpoint.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Sensitive information type

    Pattern definition that detects data such as ID numbers.

    Remember
    Custom types use regex, keywords and confidence levels.
    Tested as
    Classification questions.
    Trap
    Relying on one regex without supporting keywords.

  • Keyword dictionary vs keyword list

    Large managed term set vs a short inline list.

    Remember
    Dictionaries suit long term sets that change.
    Tested as
    Custom SIT design.
    Trap
    Putting thousands of terms in a list.

  • Retention policy

    Retention or deletion settings for entire locations.

    Remember
    Applies implicitly to all items in scope.
    Tested as
    Baseline lifecycle rules.
    Trap
    Using it for one document type.

  • Retention label

    Item-level retention or deletion setting.

    Remember
    Can declare records and be auto-applied.
    Tested as
    Specific content rules.
    Trap
    Forgetting to publish the label.

  • Principles of retention

    Rules for resolving conflicting retention settings.

    Remember
    Retention beats deletion; longest retention wins.
    Tested as
    Conflict questions.
    Trap
    Assuming the newest policy wins.

  • Sensitivity label

    Classification with protection such as encryption and marking.

    Remember
    Can scope to files, email, groups, sites and meetings.
    Tested as
    Data protection questions.
    Trap
    Expecting it to control retention.

  • Mandatory labeling

    Label policy setting that forces users to label content.

    Remember
    Set in the label policy, not the label.
    Tested as
    User behavior scenarios.
    Trap
    Looking for it in label settings.

  • Content explorer

    View of where sensitive or labeled items are stored.

    Remember
    Needs specific Content explorer roles.
    Tested as
    Discovery of stored data.
    Trap
    Using it to see who changed a label.

  • Activity explorer

    History of labeling and DLP activities.

    Remember
    Shows label applied, changed or removed events.
    Tested as
    Monitoring questions.
    Trap
    Expecting it to list all stored items.

  • DLP simulation mode

    Running a policy to see matches without enforcement.

    Remember
    Use before turning a policy on.
    Tested as
    Safe rollout.
    Trap
    Enforcing immediately on all users.

  • Microsoft 365 Copilot DLP location

    DLP location that limits Copilot use of labeled content.

    Remember
    Conditions use sensitivity labels.
    Tested as
    AI data protection scenarios.
    Trap
    Expecting SharePoint policies to cover Copilot responses.

  • Endpoint DLP

    DLP enforcement on onboarded Windows and macOS devices.

    Remember
    Controls USB, print, upload and clipboard actions.
    Tested as
    Device leakage scenarios.
    Trap
    Installing a separate DLP client.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Labels compared

ConceptMeaningKey differenceCommon trap
Retention label Keeps or deletes an item for a period Lifecycle and records Expecting encryption
Sensitivity label Classifies and protects content Encryption and visual marking Expecting retention control
Sensitive information type Detects patterns in content A condition, not a label Applying it to files directly

Retention scope

ConceptMeaningKey differenceCommon trap
Retention policy Applies to whole locations Implicit and broad Using it for one contract type
Published retention label Users choose the label Explicit, user-driven Expecting automatic application
Auto-apply retention label Applied by SIT, keywords or trainable classifiers Explicit, rule-driven Forgetting licensing and processing delay

DLP actions

ConceptMeaningKey differenceCommon trap
Audit only Records matches without user impact Visibility first Assuming it blocks
Block with override Stops action unless the user justifies it Balances control and productivity Missing override reporting
Block Stops the action entirely Strongest control Applying it before simulation

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Newest policy wins

    What candidates pick
    Assume the most recently created retention setting applies.
    Why it looks right
    Many systems use last-write rules.
    Why it's wrong
    Purview uses principles of retention, so retention beats deletion and the longest retention period wins.

    Clue to watch for Two retention settings conflict.

  2. Sensitivity label for retention

    What candidates pick
    Apply a sensitivity label so files are kept seven years.
    Why it looks right
    Labels sound like governance tools.
    Why it's wrong
    Sensitivity labels classify and protect; retention labels or policies keep and delete content.

    Clue to watch for The requirement states a time period.

  3. Label without policy

    What candidates pick
    Create a sensitivity label and expect users to see it.
    Why it looks right
    Creating it seems enough.
    Why it's wrong
    Labels must be published through a label policy before users can apply them.

    Clue to watch for Users report they cannot find the new label.

  4. Separate endpoint agent

    What candidates pick
    Install a new DLP agent on each laptop.
    Why it looks right
    Endpoint controls often need agents.
    Why it's wrong
    Endpoint DLP uses the Defender for Endpoint onboarding process already on supported devices.

    Clue to watch for Devices are already onboarded to Defender for Endpoint.

  5. SharePoint DLP for Copilot

    What candidates pick
    Use a SharePoint DLP policy to stop Copilot summaries.
    Why it looks right
    The files live in SharePoint.
    Why it's wrong
    Copilot processing is controlled by the Microsoft 365 Copilot DLP location with sensitivity label conditions.

    Clue to watch for The scenario mentions Copilot responses.

Answer framework

Use these steps to choose the right Purview control for a data scenario.

  1. Decide whether the need is detection, retention, protection, leakage prevention or monitoring, because each maps to a different Purview feature.
  2. For detection, use a built-in sensitive information type or build a custom one with a pattern, supporting keywords and confidence levels.
  3. For retention, use a policy for whole locations and a label for specific items or records, then resolve conflicts with retention principles.
  4. For protection, create sensitivity labels with encryption or marking, publish them in a label policy, and set default or mandatory labeling.
  5. For leakage, pick DLP locations including Copilot and devices, run simulation, add policy tips and overrides, then review alerts and Activity explorer.

Practice question

A company wants to stop users copying files that contain customer account numbers to USB drives. All Windows laptops are already onboarded to Microsoft Defender for Endpoint, and a custom sensitive information type for account numbers exists. What should the administrator configure?

Want more like this? The MS-102 practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Plan about a tenth of your study time here and focus on distinctions rather than depth. In your E5 trial, open the Microsoft Purview portal and create one custom sensitive information type from a regex, then test it with the built-in test feature using sample text.

Create two retention settings that conflict, such as a three-year policy on a site and a seven-year label on one document, and write down which wins and why. Build a sensitivity label with encryption and a watermark, publish it with mandatory labeling to a pilot group, and apply it in Word.

Create a DLP policy in simulation mode covering Exchange and OneDrive, then a second one for the Devices location that audits USB copies on an onboarded VM. Look up the Copilot location options and how sensitivity labels limit Copilot. Finish by opening Content explorer and Activity explorer so you know what each one shows. Short flashcards on retention principles and label types pay off quickly.

FAQ

How much of MS-102 is Domain 4, Manage compliance by using Microsoft Purview?

Microsoft weights Manage compliance by using Microsoft Purview at 10–15% of MS-102, the smallest skill area, with two functional groups: information protection with lifecycle management, and DLP.

Is eDiscovery or insider risk in MS-102 Domain 4?

Not as named objectives. The current skills list covers sensitive information types, retention, sensitivity labels, label monitoring and DLP only. eDiscovery permissions appear under roles in Domain 1.

What is the difference between Content explorer and Activity explorer?

Content explorer shows where sensitive or labeled items are stored now. Activity explorer shows events over time, such as labels being applied, changed or removed and DLP matches.

Can DLP protect data from Microsoft 365 Copilot?

Yes. The Microsoft 365 Copilot location in a DLP policy can stop Copilot from processing items that carry selected sensitivity labels.

Which wins when retention settings conflict?

Retention wins over deletion, the longest retention period wins, explicit labels win over implicit policies for deletion, and the shortest deletion period wins among deletions.

Does Endpoint DLP work on macOS?

Yes, on supported macOS versions onboarded through the Defender for Endpoint process, as well as on Windows 10 and Windows 11 devices.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have covered sensitive information types, retention, sensitivity labels, explorers and DLP across workloads, Copilot and devices. Check that you can keep these controls apart.

Take the MS-102 practice test Check your MS-102 readiness

Keep going