SC-900 · Domain 4 of 4

SC-900 Domain 4: Describe the capabilities of Microsoft compliance solutions

The compliance domain of SC-900: the Service Trust Portal and Microsoft's privacy principles, the Microsoft Purview portal and Compliance Manager, data classification, sensitivity labels, DLP, retention and records management, insider risk, eDiscovery and audit.

Exam weight
20–25%
Official functional groups
4
Estimated questions estimate
~11
Suggested study time estimate
5–8 hrs

About 12 min read Reviewed October 2026

Overview

Domain 4 covers how Microsoft supports compliance and data protection, mostly through Microsoft Purview, in four functional groups. The first covers Service Trust Portal offerings and Microsoft's privacy principles. The second covers the Microsoft Purview portal, Compliance Manager and the uses and benefits of compliance score.

The third group covers data classification, Content explorer and Activity explorer, sensitivity labels and label policies, data loss prevention, records management, and retention policies, retention labels and retention label policies. The fourth covers insider risk management, eDiscovery and audit. At 20–25%, it is the third-largest domain. Many names here sound alike, such as retention policies versus retention labels and Content explorer versus Activity explorer, so precise definitions win most of the marks.

How it's tested

Domain 4 questions usually describe a compliance or data-handling requirement, such as keeping documents for seven years, stopping credit card numbers from leaving by email, or finding content for a legal case, and ask which Purview capability fits. Others ask where to find audit reports or what compliance score measures.

  • Protect, keep or find

    A requirement is described, and you choose between sensitivity labels, DLP, retention, records management, eDiscovery or audit based on whether it protects, keeps or finds data.

  • Where is the evidence

    A request for Microsoft audit reports, certifications or privacy documentation is described, and you identify the Service Trust Portal or Compliance Manager.

  • Classification tool match

    A need to identify sensitive data is stated, and you pick sensitive information types, trainable classifiers, Content explorer or Activity explorer.

Reasoning it through

A legal team must place a hold on mailboxes and OneDrive accounts of three employees involved in litigation, then search and export relevant content. Audit records activities but does not preserve or export content. Retention policies keep data for a set period but are not case-based. eDiscovery in Microsoft Purview supports cases, legal holds, searches and export, so it meets the requirement.

Functional groups 4

Official functional groups from the Microsoft outline, in outline order.

4.1 Describe Microsoft Service Trust Portal and privacy principlesService Trust Portal offerings and Microsoft's privacy principles.
What it means
This group covers where Microsoft publishes compliance evidence about its cloud services and the principles that guide how Microsoft handles customer data.
What to understand
The Service Trust Portal provides audit reports, certifications and compliance documentation, such as ISO and SOC reports, plus industry and regional resources, the Trust Documents section and My Library for saving documents. Signing in is needed for most documents. Microsoft's privacy principles are control, transparency, security, strong legal protections, no content-based targeting, and benefits to the customer. These principles explain, for example, that customers control their data and that Microsoft does not use email or document content for advertising.
How it shows up
Expect questions on where to download an audit report or which privacy principle a statement reflects.
Common confusion
The Service Trust Portal shows Microsoft's own compliance evidence; it does not assess the customer's tenant, which Compliance Manager does.
4.2 Describe compliance management capabilities of Microsoft PurviewThe Microsoft Purview portal, Compliance Manager and compliance score.
What it means
This group explains the Microsoft Purview portal as the home of compliance and data governance tools, Compliance Manager for tracking regulatory requirements, and the compliance score it calculates.
What to understand
The Microsoft Purview portal brings together solutions such as Compliance Manager, Information Protection, DLP, Data Lifecycle Management, eDiscovery, Audit, Insider Risk Management and data governance tools. Compliance Manager uses regulations and templates, assessments, controls and improvement actions to help organizations manage compliance across Microsoft and other services. Controls are customer-managed, Microsoft-managed or shared. Compliance score measures progress in completing improvement actions, with points weighted by whether the action is mandatory or discretionary and preventive, detective or corrective. A higher score shows progress but does not guarantee compliance with any regulation.
How it shows up
You may be asked what compliance score measures, what an assessment contains, or which control types exist.
Common confusion
Compliance score is often confused with Secure Score; compliance score tracks regulatory improvement actions, not security configuration posture.
4.3 Describe information protection, data lifecycle management, and data governance capabilities of Microsoft PurviewData classification, explorers, sensitivity labels, DLP, records management and retention.
What it means
This group covers knowing your data, protecting it, preventing it from leaking, and controlling how long it is kept, using Microsoft Purview Information Protection and Data Lifecycle Management.
What to understand
Data classification uses sensitive information types, trainable classifiers and exact data match to identify sensitive content. Content explorer shows where sensitive or labeled items are; Activity explorer shows what users did with labeled content. Sensitivity labels classify and can encrypt, watermark or mark content, and label policies publish them to users with options such as mandatory labeling. DLP policies detect sensitive information in locations such as Exchange, SharePoint, OneDrive, Teams and endpoints, then warn, block or report. Retention policies apply broadly to locations, retention labels apply to individual items, and label policies publish or auto-apply them. Records management declares items as records that cannot be edited or deleted as usual.
How it shows up
Questions describe a protection, prevention or retention need and ask which label, policy or explorer meets it.
Common confusion
Sensitivity labels and retention labels are separate; one protects content, the other governs how long it stays and what happens afterward.
4.4 Describe insider risk, eDiscovery, and audit capabilities in Microsoft PurviewInsider risk management, eDiscovery and Microsoft Purview Audit.
What it means
This group covers identifying risky activity by people inside the organization, finding and preserving content for investigations, and recording user and admin activity.
What to understand
Insider risk management uses policy templates, such as data theft by departing users or data leaks, to correlate signals and create alerts for investigation, with pseudonymization to protect privacy by default. eDiscovery identifies, preserves, searches and exports content for legal or internal investigations; cases support custodians, holds, review sets and analytics depending on licensing. Microsoft Purview Audit records user and administrator activity in a searchable unified audit log; Audit (Standard) keeps records for a default period, and Audit (Premium) adds longer retention and high-value events for investigations. Communication compliance is a related Purview tool for detecting inappropriate messages.
How it shows up
Expect a scenario about departing employees, legal holds or proving who accessed a file, and pick the matching Purview feature.
Common confusion
Audit shows who did what and when; eDiscovery finds and preserves the content itself.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Service Trust Portal

    Microsoft's library of audit reports and compliance documents.

    Remember
    Shows Microsoft's evidence, not the customer's.
    Tested as
    Where-to-find questions.
    Trap
    Confusing it with Compliance Manager.

  • Microsoft privacy principles

    Six principles guiding data handling.

    Remember
    Includes no content-based targeting.
    Tested as
    Principle-matching statements.
    Trap
    Forgetting customer control and transparency.

  • Microsoft Purview portal

    Unified portal for compliance and data governance tools.

    Remember
    Hosts Compliance Manager, DLP and eDiscovery.
    Tested as
    Navigation questions.
    Trap
    Expecting Defender XDR tools there.

  • Compliance Manager

    Tracks regulatory requirements through assessments.

    Remember
    Uses controls and improvement actions.
    Tested as
    Assessment questions.
    Trap
    Thinking it certifies compliance.

  • Compliance score

    Progress score for improvement actions.

    Remember
    Weighted by action type.
    Tested as
    Score meaning questions.
    Trap
    Confusing it with Secure Score.

  • Sensitive information types

    Pattern-based detectors such as card numbers.

    Remember
    Used by labels, DLP and explorers.
    Tested as
    Classification questions.
    Trap
    Confusing them with trainable classifiers.

  • Trainable classifiers

    Machine-learning models that recognize content categories.

    Remember
    Useful when patterns cannot describe the data.
    Tested as
    Classification choice questions.
    Trap
    Choosing them for fixed-format numbers.

  • Content explorer vs. Activity explorer

    Where sensitive items are versus what users did.

    Remember
    Both live in Purview data classification.
    Tested as
    Explorer choice questions.
    Trap
    Swapping their purposes.

  • Sensitivity labels

    Classify and protect content.

    Remember
    Can encrypt, mark and watermark.
    Tested as
    Protection scenarios.
    Trap
    Using them to keep data for years.

  • Data loss prevention

    Detects and controls sharing of sensitive data.

    Remember
    Can warn, block or report.
    Tested as
    Leak prevention scenarios.
    Trap
    Thinking it encrypts files itself.

  • Retention policies vs. labels

    Location-wide versus item-level retention.

    Remember
    Labels can travel with items.
    Tested as
    Retention scenarios.
    Trap
    Using a policy where items need different periods.

  • Records management

    Declares content as records with restrictions.

    Remember
    Uses retention labels marked as records.
    Tested as
    Regulatory recordkeeping questions.
    Trap
    Confusing it with backup.

  • Insider risk management

    Detects risky actions by internal users.

    Remember
    Uses policy templates and pseudonymization.
    Tested as
    Departing employee scenarios.
    Trap
    Choosing DLP for correlated user risk.

  • eDiscovery

    Finds, holds and exports content for cases.

    Remember
    Supports legal holds.
    Tested as
    Litigation scenarios.
    Trap
    Choosing audit to preserve content.

  • Microsoft Purview Audit

    Searchable log of user and admin activity.

    Remember
    Premium extends retention and events.
    Tested as
    Who-did-what questions.
    Trap
    Expecting it to export mailbox content.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Sensitivity labels vs. retention labels vs. DLP

ConceptMeaningKey differenceCommon trap
Sensitivity labels Classify and protect content Encryption and markings Expecting retention behavior
Retention labels Keep or delete content per item Time-based lifecycle control Expecting encryption
DLP policies Detect and control sharing Acts on sensitive data in use or motion Thinking it labels files permanently

Compliance score vs. Secure Score

ConceptMeaningKey differenceCommon trap
Compliance score Progress on regulatory improvement actions Calculated in Compliance Manager Treating it as security posture
Secure Score Security configuration posture Calculated in Defender products Treating it as regulatory compliance

Audit vs. eDiscovery vs. insider risk management

ConceptMeaningKey differenceCommon trap
Audit Records activity events Answers who did what and when Expecting content preservation
eDiscovery Finds and preserves content for cases Holds and exports data Using it for continuous monitoring
Insider risk management Correlates risky user behavior Alerts on patterns like data theft Expecting it to block sharing directly

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Labels for retention

    What candidates pick
    Choose a sensitivity label to keep contracts for seven years.
    Why it looks right
    Both are labels applied to items.
    Why it's wrong
    Sensitivity labels protect content; how long content is kept is governed by retention labels or retention policies.

    Clue to watch for A time period such as years or months.

  2. Score equals compliance

    What candidates pick
    Agree that a 100% compliance score means full regulatory compliance.
    Why it looks right
    The name suggests certification.
    Why it's wrong
    Compliance score measures progress on improvement actions and does not certify that a regulation is met.

    Clue to watch for Words like guarantee, certify or prove compliance.

  3. Audit preserves content

    What candidates pick
    Choose Audit to hold mailboxes for a lawsuit.
    Why it looks right
    Audit is associated with investigations.
    Why it's wrong
    Audit records events; preserving and exporting content is the job of eDiscovery holds and searches.

    Clue to watch for Legal hold, custodians or export.

  4. DLP equals insider risk

    What candidates pick
    Pick DLP to identify employees likely to steal data before leaving.
    Why it looks right
    Both deal with data leaving the organization.
    Why it's wrong
    DLP enforces rules on individual actions; insider risk management correlates many signals about a user over time.

    Clue to watch for Departing users, patterns or risk indicators.

  5. Explorer mix-up

    What candidates pick
    Choose Content explorer to see who downloaded labeled files.
    Why it looks right
    Both explorers sit under data classification.
    Why it's wrong
    Content explorer shows where items are; Activity explorer shows actions taken on them.

    Clue to watch for The question asks about user actions.

  6. Trust portal for tenant posture

    What candidates pick
    Use the Service Trust Portal to assess the organization's own controls.
    Why it looks right
    It is full of compliance material.
    Why it's wrong
    The portal publishes Microsoft's evidence; assessing the customer's controls happens in Compliance Manager.

    Clue to watch for The organization's own regulatory progress.

Answer framework

Use these steps to map any Domain 4 compliance scenario to the right Microsoft Purview or trust capability.

  1. Decide whether the need concerns Microsoft's evidence, the organization's compliance progress, or handling the organization's own data.
  2. For Microsoft audit reports and certifications choose the Service Trust Portal; for tracking regulatory controls and scores choose Compliance Manager.
  3. For data handling, ask whether the goal is to find, protect, prevent leaks or keep data, and choose classification, sensitivity labels, DLP or retention.
  4. When retention differs by item or must be declared a record, choose retention labels and records management rather than a location-wide retention policy.
  5. For investigations, use audit for activity history, eDiscovery for holding and exporting content, and insider risk management for correlated user risk.

Practice question

A finance company must automatically warn users and block emails that contain credit card numbers when they are sent to external recipients from Exchange Online and Teams. Which Microsoft Purview capability should the company configure?

Want more like this? The SC-900 practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Plan five to eight hours. Start with the two quick topics, the Service Trust Portal and Microsoft's privacy principles, then learn Compliance Manager's building blocks: assessments, templates, controls, improvement actions and compliance score. Write a one-line answer to the question of what compliance score does not prove.

The third functional group is the longest, so give it the most time. Arrange its features in the order data moves: classify with sensitive information types and trainable classifiers, inspect with Content explorer and Activity explorer, protect with sensitivity labels, prevent leaks with DLP, and keep or delete with retention and records management.

For the final group, build a three-way table for insider risk management, eDiscovery and audit with the question each one answers. Microsoft Learn's SC-900 compliance modules and the Purview portal demo screenshots in documentation are enough for this depth. End with mixed practice questions focused on label types and investigation tools.

FAQ

How much of SC-900 is Domain 4, Describe the capabilities of Microsoft compliance solutions?

Domain 4 is 20–25% of the exam and has four functional groups covering the Service Trust Portal and privacy, compliance management, information protection and lifecycle, and insider risk, eDiscovery and audit.

Is the Microsoft Purview compliance portal still the name used?

The current study guide refers to the Microsoft Purview portal, which hosts the compliance and data governance solutions. Older material may mention the compliance portal.

Does a high compliance score mean we are compliant?

No. Compliance score shows progress on recommended improvement actions. Meeting a regulation depends on many factors, and the score is a tracking aid, not a certification.

What is the difference between a retention policy and a retention label?

A retention policy applies settings to whole locations such as mailboxes or sites. A retention label applies to individual items and can differ from item to item.

Are sensitivity labels and DLP the same thing?

No. Sensitivity labels classify and can protect content with encryption or markings. DLP policies watch for sensitive data being shared and can warn or block. DLP can use labels as a condition.

Is communication compliance in scope?

The current study guide lists insider risk, eDiscovery and audit in the final group. Knowing that communication compliance exists in Purview is useful context, but it is not a named bullet.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have covered the Service Trust Portal, Compliance Manager, classification, labels, DLP, retention, insider risk, eDiscovery and audit. See how well you separate similar Purview features.

Take the SC-900 practice test Check your SC-900 readiness

Keep going