Activity explorer scoping to AU

From my understanding, Administrative Unit scoping in Purview should restrict what a scoped/restricted admin can see, including DLP-related alerts and Activity Explorer events, but the behavior can depend on the exact workload, policy scope, and the permissions assigned to the admin account.

One important point is that the restricted admin should not have any additional unscoped roles, such as Compliance Administrator, Security Reader, Security Administrator, Information Protection-related roles, or any broader Purview/M365 role that could override the AU restriction. https://learn.microsoft.com/en-us/purview/purview-permissions#role-precedence-and-scope-behavior

It is also worth checking whether the DLP policy itself is scoped to the Administrative Unit, and whether the activity being shown is linked to an in-scope resource, such as a SharePoint site or OneDrive location, even if the user displayed in the activity is outside the AU.

So if the admin can see activity for users outside the scoped AU, I would first validate:

1. Review all role assignments for the restricted admin and confirm there are no unscoped or tenant-wide roles.
2. Confirm whether the DLP policy is global or scoped to the Administrative Unit.
3. Check whether the activity is tied to an in-scope resource, especially a SharePoint site, OneDrive account, mailbox, or device.
4. Confirm whether the specific workload and activity type support AU scoping.

So, to answer the question: yes, AU scoping should restrict what the admin can see, but seeing users outside the AU can make sense if the activity is tied to an in-scope resource or if the admin has another broader role assignment.
If the admin can see activity where the user, resource, policy context, and workload are all outside the Administrative Unit — and there are no unscoped roles involved — then I would consider that unexpected and worth raising with Microsoft Support.