Step 1 - Scenario
You need to grant User1 permission to search Microsoft 365 audit logs while following the principle of least privilege.
Step 2 - Roles that can search audit logs
Audit log search in Microsoft 365 is tied to Exchange Online role groups, because audit log data is stored in Exchange.
The following roles are relevant:
View-Only Audit Logs # Grants the ability to search and view audit logs, but not configure auditing or take other compliance actions. This is the least privilege role.
Audit Logs # Grants broader permissions, including turning auditing on/off.
Compliance Management # A broader role group that includes audit log search and many other compliance functions, violating least privilege.
Security Reader (Entra ID) # Grants read-only access to security features, but not audit logs.
Reviewer (Purview) # Used in eDiscovery, not audit logs.
Step 3 - Why "View-Only Audit Logs" is correct
According to Microsoft documentation:
"Users must be assigned the Audit Logs or View-Only Audit Logs role in Exchange Online to search the audit log. To minimize permissions, assign View-Only Audit Logs."
# Reference: Permissions required to search the audit log
Step 4 - Elimination of other options
A). Security Reader role # Allows reading security-related info in Microsoft 365 Defender, not Purview audit logs.
B). Compliance Management role # Includes more than just audit logs, not least privilege.
C). View-Only Audit Logs role # Correct and least privilege.
D). Reviewer role # For eDiscovery cases, not audit logs.

When you create a communication compliance policy in Microsoft Purview and select "Detect Microsoft Copilot interactions," certain trainable classifiers are automatically added to help detect sensitive or inappropriate AI usage.
The "Unauthorized disclosure" classifier helps detect cases where users might share confidential or sensitive information via Copilot interactions, preventing unintended data leaks. The "Protected Materials" classifier is used to identify sensitive or restricted content that should not be shared through Copilot, ensuring compliance with organizational policies.

Microsoft 365 Copilot can only process (summarize, answer questions about) a labeled file when the user has the Copy and extract content (EXTRACT) usage right granted by the applied sensitivity label.
From the table of labels:
* Label1 # VIEW only (no EXTRACT) # Copilot cannot summarize.
* Label2 # VIEW and EXTRACT granted # Copilot can summarize.
* Label3 # VIEW and EXPORT (no EXTRACT) # Copilot cannot summarize.
Since File2 is labeled Label2, it's the only file for which User1 has the required EXTRACT permission, so it' s the only file Copilot can summarize.
References:
Microsoft Learn - Sensitivity labels and Copilot for Microsoft 365: Copilot requires the Copy and extract content (EXTRACT) permission to process labeled content.https://learn.microsoft.com/microsoft-365
/compliance/sensitivity-labels-copilot
Microsoft Learn - Usage rights for encryption with sensitivity labels (VIEW, EXTRACT, EXPORT definitions)https://learn.microsoft.com/microsoft-365/compliance/encryption-sensitivity-labels#usage-rights- and-permissions

Explanation:

EDM does not store raw data; instead, it requires hashed versions of sensitive data for privacy and security.
To upload the hashed data, Microsoft provides the EDM upload agent. This ensures that the data is securely processed and recognized by the EDM service in Microsoft 365.

Explanation:

Step 1 - Scenario
The requirement is to ensure Microsoft Purview Insider Risk Management can collect signals when a user copies files to a USB device using their default browser. The devices differ by browser type:
Device1 # Default browser = Microsoft Edge
Device2 # Default browser = Google Chrome
Step 2 - Signal collection methods in Insider Risk Management
Insider Risk Management uses Microsoft Purview Information Protection client and Purview browser extensions to collect activity signals.
For Microsoft Edge (Chromium-based), insider risk signals are collected via the Microsoft Purview Information Protection client.
For Google Chrome, signals are collected through the Microsoft Purview extension (available in the Chrome Web Store).
The Microsoft Defender Browser Protection extension is for web protection against malicious sites, not for insider risk activity signals, so it is irrelevant here.
Step 3 - Microsoft Reference
Microsoft documentation:
"For insider risk signals collection in Microsoft Edge, the Microsoft Purview client must be deployed. For Google Chrome, the Microsoft Purview extension is required." Reference: Insider risk management activity signals