Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Purview complianceHard
A financial institution needs to implement a policy to ensure that no sensitive client financial data, identified by specific custom regular expressions for account numbers, is ever stored in unmanaged devices or personal cloud storage services (e.g., Dropbox, Google Drive). The policy must also prevent this data from being copied to USB drives. Which Microsoft Purview feature is primarily responsible for detecting and enforcing these restrictions?
- AConditional Access policies
- BInsider Risk Management
- CData Loss Prevention (DLP) for endpoints
- DInformation Barriers
Show answer & explanationAnswer & explanation
Correct answer: C. Data Loss Prevention (DLP) for endpoints
DLP for endpoints extends Data Loss Prevention capabilities to Windows and macOS devices, allowing organizations to detect and prevent sensitive information from being copied to USB drives, unmanaged cloud services, or printed, thereby protecting data even when it leaves Microsoft 365 services.
Why the other options are wrong
- A. Conditional Access policies control access to resources based on conditions (e.g., device compliance, location) but don't prevent data from being copied to local storage or personal cloud services once accessed.
- B. Insider Risk Management detects risky user behaviors but doesn't directly enforce real-time blocking of data transfers to unmanaged devices or cloud services.
- D. Information Barriers segment user groups and prevent communication between them, not data transfer to external storage.
DLP for Endpoints
A Microsoft Purview Data Loss Prevention capability that extends DLP policies to Windows and macOS devices, enabling monitoring and protection of sensitive information as it's used and shared on endpoints.
- Prevents data transfer to USB, network shares, cloud services, print.
- Applies to Windows and macOS devices.
- Requires device onboarding to Microsoft 365 Defender.
Memory trick: DLP for Endpoints: 'Don't Let Personal data Leave' your computer!