Question

Contoso's HR system flags employees who have submitted resignations. The security team wants Purview Insider Risk Management to automatically detect when these specific employees download unusual volumes of SharePoint data or copy files to USB devices during their notice period, but they do not want to monitor the entire workforce for these behaviors. Which approach should you configure to meet this requirement most efficiently?

Accepted Answer

Create a policy using the 'Data theft by departing users' template and configure the Microsoft 365 HR connector to import termination and resignation date events.

Answer

Create a policy using the 'Data leaks' template and manually add each departing user to the in-scope users list every time HR flags one.

Answer

Create a policy using the 'General data leaks' template scoped to all users and rely on Adaptive Protection to raise the risk level of departing users.

Answer

Create a Data Loss Prevention policy that blocks USB transfers and large SharePoint downloads for all users in the organization.