Question

A financial services firm must detect and act on insider threats where employees exfiltrate sensitive client data before resigning. Compliance requires that risky user behavior (mass downloads, data staged to USB or personal cloud) automatically raise the user's risk level, and that separately, offensive or harassing internal communications be reviewed by a designated reviewer group with segregation from IT admins. The architect must design a solution using Microsoft Purview that links behavioral risk signals to remediation while keeping communication review duties separated. Which design best meets these requirements?

Accepted Answer

Use Microsoft Purview Insider Risk Management policies for data theft/exfiltration indicators, integrate its risk signals with Adaptive Protection to dynamically enforce stricter DLP, and configure Communication Compliance with role-based reviewer groups scoped separately from Global/IT admins.

Answer

Configure Microsoft Sentinel analytics rules on audit logs to detect mass downloads and route all communication review to the SOC tier-2 analysts using automation playbooks.

Answer

Apply endpoint DLP policies alone to block USB and cloud egress, and grant Global Administrators access to review all flagged communications to ensure full oversight.

Answer

Enable Entra ID Identity Protection risk policies to raise user risk on anomalous downloads, and use Purview eDiscovery to review offensive communications after an incident.