Question

Your organization has deployed Purview Insider Risk Management with a data theft by departing users policy. HR uses a third-party system to track resignations and terminations. Compliance leadership wants departing-user events to feed Insider Risk Management automatically each night without manual intervention. As the Insider Risk Management admin, what should you configure to reliably deliver these HR events to the policy?

Accepted Answer

Set up the HR data connector in the Microsoft Purview portal and schedule a scripted CSV upload to the connector's API endpoint on a recurring basis

Answer

Enable the Microsoft 365 HR audit indicator under policy settings so resignations are detected from Exchange mailbox activity

Answer

Add the departing users as priority user groups and manually update the group membership whenever HR reports a resignation

Answer

Configure a Defender for Endpoint integration so device offboarding signals are treated as HR departure events