You have a Microsoft 365 E5 subscription. You are implementing insider risk management. You need to maximize the amount of historical data that is collected when an event is triggered. What is the…

30 days is a valid lookback option but is not the maximum available setting, so selecting it reduces the amount of historical context collected before a triggering event.

60 days is a valid lookback option but does not represent the maximum - choosing it leaves 30 additional days of potential historical data uncollected.

The past activity detection setting in Insider Risk Management policy configuration allows administrators to configure a lookback window of up to 90 days prior to a triggering event. Selecting 90 days instructs the system to pull the maximum available historical signals - such as file downloads, emails, and browsing - once a trigger is detected. No configuration option exists beyond this 90-day ceiling.

180 days exceeds the maximum supported lookback window - Insider Risk Management does not allow collection of historical activity beyond 90 days prior to a triggering event.