Correct Answer: B
Explanation:
Microsoft Purview Data Security Posture Management (DSPM) provides centralized visibility into sensitive information and its use across Microsoft 365 workloads, including interactions with Microsoft 365 Copilot.
DSPM includes reporting and investigation capabilities that help administrators understand how users interact with organizational information through AI applications.
The AI activity exploration capabilities provide information about Copilot interactions, including associated users, referenced files, sensitivity labels, and potentially sensitive information.
Because the financial files are classified with the Confidential sensitivity label, administrators can investigate activity involving labeled content and determine which users referenced sensitive organizational files during Copilot interactions.
DSPM minimizes administrative effort by providing predefined dashboards, reports, and integrated investigation workflows instead of requiring administrators to construct individual audit searches.
Option A is incorrect because Microsoft Entra audit logs primarily record identity and directory administrative activities, rather than providing detailed Copilot file-reference investigations.
Option C is incorrect because Content explorer identifies and examines classified organizational content. It is not the primary solution for correlating Copilot interactions with users and referenced files.
Option D is incorrect because Data Lifecycle Management manages retention and deletion requirements rather than providing dedicated AI interaction monitoring.
Therefore, Data Security Posture Management is the appropriate solution.
Microsoft Reference:
https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about
https://learn.microsoft.com/en-us/purview/ai-m365-copilot