Purview activity explorer

Question

What behavior is expected if we delete policy/rules which previously captured events in activity explorer, will they still be available in activity explorer for analysis? or events of that policy/rules will also be deleted automatically? I believe those events will still be available for review till audit retention period.

Answer 1

Hi Vijay Sudhakar Shukla,

This is an expected and supported behavior in Microsoft Purview, and your understanding is correct.

When you delete a policy or rule that was previously capturing events in Activity Explorer, it only stops capturing new events going forward. Any events that were already logged by that policy are not removed and will continue to be available in Activity Explorer for investigation and analysis.

This works because Activity Explorer is powered by the Microsoft 365 unified audit logs. Once an activity is recorded in the audit log, it is stored independently of whether the underlying policy, rule, or sensitivity label still exists. Even if a policy or label is deleted later, historical audit events remain visible until they naturally expire based on your tenant’s audit retention settings.

Microsoft documentation also confirms that when labels or policies are deleted, past events are retained (sometimes showing the GUID instead of the friendly name), which proves the events themselves are not automatically deleted.

Deleting a Purview policy or rule does not delete historical events from Activity Explorer. It only prevents future events from being captured. All previously recorded events remain available for review until the configured audit retention period expires, after which they are automatically purged by the system.

This means there is no data loss, and the customer can continue their analysis using existing Activity Explorer data without concern.

Microsoft Reference Links

• Get started with Activity Explorer (data source and retention behavior) https://learn.microsoft.com/purview/data-classification-activity-explorer
• Activities and events captured in Activity Explorer https://learn.microsoft.com/purview/data-classification-activity-explorer-available-events
• Audit log retention policies and duration https://learn.microsoft.com/purview/audit-log-retention-policies
• Microsoft Q&A confirmation of this exact scenario https://learn.microsoft.com/answers/questions/5860762/purview-activity-explorer

Hope this helps. If you have any follow-up questions, please let me know. I would be happy to help.

Please do not forget to "Accept Answer" and "up-vote" wherever the information provided helps you, as this can be beneficial to other community members.

Answer 2

Events that were already captured in Activity explorer remain available for analysis even if the underlying policies, rules, or labels are later changed or deleted.

Relevant behavior from the documentation:

• Activity explorer data is sourced from the Microsoft 365 unified audit logs and transformed into Activity explorer views, with up to 30 days of historical data retained, independent of current policy/label configuration.
• When sensitivity labels are deleted, historical events involving those labels still appear in Activity explorer; only the label name changes to show the GUID of the deleted label instead of its friendly name. This demonstrates that historical events are not removed when configuration objects are deleted.
• Similarly, retention label events (applied/changed/removed) and DLP policy match events are logged at the time of the activity and remain in Activity explorer for the retention window, regardless of later changes to the policies or labels that generated them.

Therefore, deleting policies or rules does not automatically delete their previously captured events from Activity explorer; those events remain visible until they age out of Activity explorer’s data retention period.

---

References:

• Get started with activity explorer
• Labeling activities available in Activity explorer
• Power BI implementation planning: Auditing of information protection and data loss prevention for Power BI