Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft compliance solutionsMedium
An organization is concerned about potential data exfiltration by employees nearing termination. They want to identify unusual activities like mass downloads to USB drives or access to sensitive files outside of normal working hours, and receive alerts to investigate these behaviors. Which Microsoft Purview capability is most suitable for this scenario?
- AMicrosoft Purview Communication Compliance
- BMicrosoft Purview eDiscovery (Premium)
- CMicrosoft Purview Data Loss Prevention
- DMicrosoft Purview Insider Risk Management
Show answer & explanationAnswer & explanation
Correct answer: D. Microsoft Purview Insider Risk Management
Microsoft Purview Insider Risk Management is designed to detect, investigate, and act on malicious and inadvertent insider activities, such as data exfiltration by departing employees, by correlating various signals.
Why the other options are wrong
- A. Communication Compliance monitors communications for policy violations, harassment, or regulatory compliance, not general data exfiltration patterns.
- B. eDiscovery is for legal investigations and document collection, not for proactive detection of insider threats.
- C. DLP focuses on preventing sensitive data from leaving defined boundaries, but Insider Risk Management specifically targets patterns of risky user behavior.
Insider Risk Management
A Microsoft Purview solution that helps organizations detect, investigate, and act on malicious and inadvertent insider activities to minimize internal risks.
- Detects risky user behaviors
- Correlates various signals (e.g., downloads, emails)
- Helps investigate and remediate insider threats
Memory trick: Watch for the patterns, catch the insiders.