Question

A financial services company must comply with a regulation requiring that customer records containing account numbers and national ID numbers cannot be copied to USB drives, uploaded to unmanaged cloud services, or pasted into consumer webmail from corporate Windows endpoints. Security architects also need policy actions to differ by user group: the compliance team should be allowed to override with business justification, while general staff must be hard-blocked. Which design best translates this regulatory requirement into enforceable controls?

Accepted Answer

Create Microsoft Purview sensitive information types (or trainable classifiers) for the data, then deploy Microsoft Purview Endpoint DLP policies with egress rules for USB, cloud upload, and clipboard, using block-with-override for the compliance group and hard block for general staff.

Answer

Configure Azure Policy definitions that deny storage account public access and require encryption, mapped to the regulatory compliance dashboard in Defender for Cloud.

Answer

Enable Microsoft Purview Information Protection sensitivity labels with encryption and rely on the labels alone to prevent copying data to USB and webmail.

Answer

Deploy Conditional Access policies with session controls through Defender for Cloud Apps to block downloads, and enforce device compliance for all corporate endpoints.