Forum Discussion
Not seeing all activity
While doing some reading I came across the below article about viewing label activity
https://docs.microsoft.com/en-us/microsoft-365/compliance/data-classification-activity-explorer
The article says you can see a number of activities listed as:
- File created
- File modified
- File renamed
- File copied to cloud
- File accessed by unallowed app
- File printed
- File copied to removable media
- File copied to network share
- File read
- file copied to clipboard
- Label applied
- Label changed (upgraded, downgraded, or removed)
My problem is when I go to the Label activity explorer I only have two options (Label Activities and Label changes). I don't see all the other useful activities such "File copied to removable media". I have the necessary license, Office 365 (E5), applied to the accounts.
I've done testing by copying a labeled file to a USB and get no activity. I think I have all the right permissions but maybe there is a role or permission within the Security and Compliance portal I need?
Can anyone help shed some light on this?
1 Reply
- Yes, in short, you need Microsoft Defender ATP if you want to have visibility in the logs for events such as copying files to USB and many of the other items above. https://techcommunity.microsoft.com/t5/azure-information-protection/discover-and-protect-sensitive-data-through-azure-information/ba-p/297292
