Question

A compliance analyst at a manufacturing company wants to understand the level of potential insider risk activity across the organization before committing to creating specific Insider Risk Management policies. They need aggregated, de-identified insights to justify which policy types to configure without immediately naming individual users. Which Insider Risk Management capability should they use first?

Accepted Answer

Run analytics scans to view aggregated, anonymized insights into potential risky activities across the tenant

Answer

Immediately create a Data theft by departing users policy and review the generated alerts

Answer

Configure a Communication Compliance policy to scan outbound email for risky language

Answer

Open Content Explorer in data classification to view files containing sensitive information types