Question

Your organization uses Microsoft Purview Insider Risk Management with Adaptive Protection enabled. Security leadership wants users who reach an 'Elevated' insider risk level to be automatically subjected to stricter DLP enforcement (blocking, rather than just auditing, the copying of sensitive files to USB), while lower-risk users continue with audit-only actions. You must configure a DLP policy that changes enforcement based on the user's current risk level without manually maintaining user lists. What should you do?

Accepted Answer

Configure Adaptive Protection in Insider Risk Management, then create a DLP policy that uses the 'Insider risk level' condition to apply the block action only when the user's level is Elevated.

Answer

Create a single Endpoint DLP policy scoped to a static distribution group and manually add users flagged as Elevated risk each day.

Answer

Create two separate DLP policies with different priorities and assign users to each based on an adaptive policy scope built from a Microsoft Entra dynamic group.

Answer

Enable just-in-time protection in Endpoint DLP settings so that all files are blocked until the user's risk level is evaluated.