Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Purview complianceMedium
A global manufacturing company has several employees who handle highly confidential intellectual property (IP) related to new product designs. These employees are considered 'IP Custodians'. The company wants to monitor unusual activities, such as large downloads of IP documents, emailing IP documents to personal accounts, or deleting large numbers of IP files, especially when an IP Custodian is about to leave the company. Which Microsoft Purview solution is best suited to address this specific concern?
- AData Loss Prevention (DLP)
- BCommunication Compliance
- CInsider Risk Management
- DInformation Barriers
Show answer & explanationAnswer & explanation
Correct answer: C. Insider Risk Management
Insider Risk Management is specifically designed to detect and act on risky activities by internal users, such as data exfiltration by departing employees or unusual access/download patterns, by correlating various signals and prioritizing alerts.
Why the other options are wrong
- A. DLP prevents specific sensitive data from leaving, but doesn't focus on behavioral patterns or 'about to leave' scenarios.
- B. Communication Compliance monitors internal communication content, not user behavior around data access/movement.
- D. Information Barriers prevent communication between user groups, which is not the primary goal here.
Insider Risk Management
Microsoft Purview Insider Risk Management helps organizations detect, investigate, and act on malicious and inadvertent insider activities that could lead to data theft, data leakage, or regulatory compliance violations.
- Correlates various signals (e.g., activity logs, HR data).
- Identifies risky user behaviors, especially for departing employees.
- Provides dashboards and alerts for investigation.
Memory trick: Insider Risk: Watch the 'inside' moves!