Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Purview complianceMedium
A financial services organization is concerned about potential data exfiltration by departing employees. Specifically, they want to detect and prevent employees who are about to leave the company from downloading large volumes of sensitive client data from SharePoint Online to personal devices. Which Microsoft Purview solution is best suited to proactively identify and mitigate this specific risk?
- ACommunication Compliance policies to monitor email and Teams chats
- BInsider Risk Management policies with a 'Departing Employees' template
- CData loss prevention (DLP) policies configured for SharePoint Online
- DInformation barriers to restrict communication
Show answer & explanationAnswer & explanation
Correct answer: B. Insider Risk Management policies with a 'Departing Employees' template
Insider Risk Management is specifically designed to detect and act on risky activities by internal users, including data exfiltration by departing employees. It uses machine learning and analytics to correlate various signals (e.g., large downloads, unusual access patterns, HR resignation data) to identify and mitigate such risks, often leveraging predefined templates like 'Departing Employees'.
Why the other options are wrong
- A. Communication Compliance focuses on inappropriate communications, not data exfiltration patterns from cloud storage to personal devices.
- C. DLP policies can prevent data exfiltration but are more focused on content-based detection and less on the user's intent or employment status context.
- D. Information barriers prevent communication between user groups, not data exfiltration by individuals.
Insider Risk Management
A Microsoft Purview solution that uses machine learning and analytics to identify, investigate, and act on risky activities by internal users, such as data theft or policy violations.
- Detects malicious or inadvertent insider risks.
- Integrates with HR systems (e.g., for departing employees).
- Correlates activity signals across Microsoft 365 services.
- Provides alerts and workflows for investigation and remediation.
Memory trick: Insider Risk: Spot the 'inside job' before it hurts.