You have a Microsoft 365 E5 subscription that contains a user named User1. You deploy Microsoft Purview insider risk management. You need ensure that insider risk management events related to User1…

The correct answer is D. a priority user group. Priority user groups in Insider Risk Management serve a dual purpose: they flag specific users for elevated monitoring AND enable role-based access scoping. When User1 is placed in a priority user group, only Insider Risk Management Investigators explicitly assigned to manage…

Manage risks, alerts, and activities

Question

You have a Microsoft 365 E5 subscription that contains a user named User1. You deploy Microsoft Purview insider risk management. You need ensure that insider risk management events related to User1 are visible only to specific users. What should you create?

Options

Aa detection group
Ba global exclusion
Can indicator variant
Da priority user group

How the community answered

(34 responses)

A
15% (5)
B
3% (1)
C
6% (2)
D
76% (26)

Explanation

Priority user groups in Insider Risk Management serve a dual purpose: they flag specific users for elevated monitoring AND enable role-based access scoping. When User1 is placed in a priority user group, only Insider Risk Management Investigators explicitly assigned to manage that group can view alerts, cases, and activity for User1. Investigators without that scoped assignment cannot see User1's data at all. Detection groups, global exclusions, and indicator variants are unrelated to access control - they govern detection logic, not who can view the results.

Topics

#Insider Risk Management#Microsoft Purview#Priority User Groups#Event Visibility

Community Discussion

No community discussion yet for this question.

Full SC-401 Practice