Labeling activities available in Activity explorer

Sensitivity label applied

This event is generated each time you label an unlabeled document or send an email with a sensitivity label.

• Activity explorer captures this event when you save a labeled document in native Microsoft Office applications and web applications.
• It captures this event when you apply a label for the Microsoft Purview Information Protection client.
• You can also monitor upgrade and downgrade label actions through the Label event type field and filter.

Sensitivity label changed

This event is generated each time a sensitivity label is updated on the document or email.

• For the Microsoft Purview Information Protection client and scanner, and MIP SDK sources, the upgrade label and downgrade label action maps to Activity explorer label changed.
• The event is captured when the action is saved in native Microsoft Office applications and web applications.
• The event is captured when the action occurs for the Microsoft Purview Information Protection client and scanner enforcements.
• You can also monitor upgrade and downgrade labels actions via the Label event type field and filter. The justification text is also captured, except for SharePoint and OneDrive.
• Sensitivity labeling in Microsoft Office apps: Outlook collects the last action that was generated before file save/email send actions. For example, if the user changes label on an email multiple times before sending, the last label found on the email when it is sent is captured in the audit log and then reported in activity explorer.

Sensitivity label removed

This event is generated each time you remove a sensitivity label from a file or document.

• Microsoft Office applications and web applications capture this event when you save the document.
• Microsoft Purview Information Protection client captures this event when you remove the label.
• Sensitivity labeling in Microsoft Office: Outlook collects the last labeling event that was generated before file save/email send actions.

Sensitivity label file read

This event is generated each time a sensitivity labeled or protected document is opened.

Files discovered

The Microsoft Purview Information Protection scanner generates this event each time it discovers files while scanning sensitive data in various locations.

Sensitivity label file renamed

This event is generated each time you rename a document with a sensitivity label.

File removed

The Microsoft Purview Information Protection scanner generates this event each time it detects that a previously scanned file is removed.

Protection applied

This event is generated the first time you manually add protection to an item that doesn't have a label.

Protection changed

This event is generated each time you manually change the protection on an unlabeled document.

Protection removed

This event is generated each time you manually change the protection on an unlabeled document.

Data loss prevention (DLP) policy matched

This event is generated each time a DLP policy matches a document or an email.

The Endpoint DLP events for devices running Windows 10, Windows 11, and any of the three most recently released major versions of macOS are:

• File deleted
• File created
• File copied to clipboard
• File modified
• File read
• File printed
• File renamed
• File copied to network share
• File accessed by unallowed app

Retention label applied

This event is generated each time you label an unlabeled document or send an email with a retention label.

• The event is captured when you save a document or send an email.

Retention label changed

This event is generated each time you update a label on a document or email.

• The event is captured when you save a document or send an email.

Retention label removed

This event is generated each time you remove a label from a file or document.

• The event is captured when you save a document or send an email.

Considerations

• When the recommended label tool tip appears to an end user, the event isn't captured. However, if the user chooses to apply the recommended label, the label appears under the How applied field as Recommended.

• Sensitive information types aren't currently available for auto-labeling activities from Word, Excel, PowerPoint, and Outlook, SharePoint, and OneDrive.

• When you label items with a sensitivity label and then delete that label, any events involving those items still appear in activity explorer. Instead of showing the name of the deleted sensitivity label, the GUID of the deleted sensitivity label appears.