Question

Contoso wants its Insider Risk Management policies to detect when a user copies sensitive files to a USB removable device or uploads them to an unsanctioned cloud service. The security team confirms Microsoft Defender for Endpoint is deployed to all managed workstations. After creating a Data Theft policy, the analyst notices that USB and cloud-upload activities are not appearing as detected indicators. What must the analyst configure to enable these device-based signals in Insider Risk Management?

Accepted Answer

Turn on the Device indicators in Insider Risk Management settings and ensure the Defender for Endpoint integration (data sharing to Microsoft Purview) is enabled

Answer

Create a DLP policy targeting the Devices location and reference it as the sole source for the Insider Risk policy

Answer

Enable Adaptive Protection so that device risk levels are automatically forwarded to the Insider Risk policy

Answer

Onboard the workstations to Microsoft Defender for Cloud Apps and connect it as an Insider Risk connector