Question

You are a security administrator at Contoso. Leadership is concerned about potential data leakage but is hesitant to deploy Insider Risk Management policies broadly because they worry about generating excessive alerts and impacting user privacy. They want to first understand the scope of potentially risky activities across the organization without configuring any specific policies or identifying individual users. What should you enable in Insider Risk Management to satisfy this requirement?

Accepted Answer

Turn on analytics to run a scan that provides aggregated, anonymized insights into potential risky activities before creating policies

Answer

Create a data leaks policy with a broad scope covering all users and review the generated alerts

Answer

Enable Adaptive Protection to automatically assign risk levels to all users

Answer

Configure forensic evidence capture to record activity on all managed devices