DLP investigation: roles and where to triage alerts
This sheet compares Manage alerts + DLP Compliance Mgmt, Content Explorer Content Viewer, Information Protection Reader.
| Criterion | Manage alerts + DLP Compliance Mgmt | Content Explorer Content Viewer | Information Protection Reader |
|---|---|---|---|
| Unlocks | DLP Alerts dashboard in Purview/Defender XDR | Content preview and Matched sensitive content on an alert | Read-only Activity explorer |
The verdict, the full comparison, 6 rules and 3 traps are part of SC-401 access. Unlock SC-401.