Pass MS-102 Exam Guide

[References:, https://docs.microsoft.com/en-us/office365/securitycompliance/search-the-audit-log-in-security-and-compliance#step-3-filter-the-search-results, , , , , , ]

[References:, https://docs.microsoft.com/en-us/office365/securitycompliance/retention-policies, , EU PII wants both documents and email message to be preserved so S&C Admin Center for Retention. If this was for Email only, this probably could have been done in EAC., , , ]

[References:, https://www.sherweb.com/blog/ediscovery-office-365/, , , , ]

[References:, https://docs.microsoft.com/en-us/office365/securitycompliance/data-loss-prevention-policies, , This report also shows policy matches over time, like the policy matches report. However, the policy matches report shows matches at a rule level; for example, if an email matched three different rules, the policy matches report shows three different line items. By contrast, the incidents report shows matches at an item level; for example, if an email matched three different rules, the incidents report shows a single line item for that piece of content. Because the report counts are aggregated differently, the policy matches report is better for identifying matches with specific rules and fine tuning DLP policies. The incidents report is better for identifying specific pieces of content that are problematic for your DLP policies., , , ]