Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft compliance solutionsMedium
An organization is concerned about potential insider risks, specifically the exfiltration of intellectual property by departing employees. They want to implement a solution that can detect unusual data download activities, email forwarding, and file renaming by users who have recently resigned. Which Microsoft Purview capability is best suited for this scenario?
- AeDiscovery Premium
- BAdaptive Protection
- CData Lifecycle Management
- DInsider Risk Management
Show answer & explanationAnswer & explanation
Correct answer: D. Insider Risk Management
Insider Risk Management in Microsoft Purview is specifically designed to detect, investigate, and act on malicious and inadvertent activities by users that could lead to data leakage or intellectual property theft.
Why the other options are wrong
- A. eDiscovery Premium is used for legal hold, search, and review of electronically stored information for legal cases, not proactive insider threat detection.
- B. Adaptive Protection is a newer capability that dynamically adjusts controls based on risk, but Insider Risk Management is the core solution for detecting insider threats.
- C. Data Lifecycle Management focuses on retention and deletion policies for data, not detecting malicious user behavior.
Insider Risk Management
A Microsoft Purview solution that helps organizations detect, investigate, and act on malicious and inadvertent activities that could lead to data leakage or intellectual property theft.
- Uses indicators like unusual downloads, email forwarding, file renaming.
- Identifies risks from departing employees, disgruntled employees, etc.
- Integrates with HR data for early detection.
Memory trick: Manage risks from the INSIDE.