Clarification on collection policies

Hello ViktorMalum,

1. If Always audit file activity for devices is enabled, then by default, when devices are onboarded, activity for Office, PDF, and CSV files is automatically audited and available for review in activity explorer. 
2. If you want to restrict this for certain file actions only, for example, 'File Created' and 'File Modified' activities only to be audited, the same can be achieved using collection policy. 
3. If Always audit file activity for devices isn't enabled, no activity is collected for devices even when there is a collection policy. This universal setting should be enabled to audit any activity. 

To your query, 

Scenario1: 

1. You have Always audit file activity for devices enabled.
2. You have a collection policy for File uploaded to cloud activity, enabled and scoped to devices.

Result: You should see this activity (Office, pdf, csv) in activity explorer. 

Scenario2: You have Always audit file activity for devices enabled. No collection policy configured. 

Result: You should see all activities (Office, pdf, csv) in activity explorer. 

Scenario3: You have Always audit file activity for devices not enabled. 

Result: You will not see any activity under activity explorer. 

Hope that clarifies. 

References: https://learn.microsoft.com/en-us/purview/dlp-configure-endpoint-settings#always-audit-file-activity-for-devices 

Collection policies policy reference | Microsoft Learn

Regards,

PI

Please mark as solution, if you find the answer helpful. This will assist others in the community who encounter a similar issue, enabling them to quickly find the solution and benefit from the guidance provided.