Question

A financial services firm uses Microsoft Purview Insider Risk Management to detect risky user behavior such as mass downloads and data exfiltration attempts before employee departures. The compliance architect wants DLP enforcement to automatically become more restrictive for users who exhibit elevated risky activity, while keeping standard users unimpeded to avoid productivity friction. The solution must adjust enforcement dynamically as a user's risk level changes, without security analysts manually reassigning DLP policies. Which design meets these requirements?

Accepted Answer

Configure Adaptive Protection in Insider Risk Management to assign dynamic risk levels (minor, moderate, elevated) and integrate them with DLP policies scoped by insider risk level condition.

Answer

Create separate DLP policies for each business unit and have analysts move flagged users into a higher-restriction security group when Insider Risk alerts fire.

Answer

Enable Conditional Access risk-based policies so that high-risk users are blocked from downloading files across all Microsoft 365 apps.

Answer

Use Sentinel automation rules to trigger a playbook that rewrites DLP policy definitions whenever an Insider Risk incident is created.