SC-401 · Question #73
You have a Microsoft 365 E5 subscription. You plan to use Microsoft Purview insider risk management. You need to create an insider risk management policy that will detect data theft from Microsoft…
The correct answer is B. Configure an HR data connector. To detect data theft correlated with resignation or upcoming employment termination, Microsoft Purview Insider Risk Management must know which users have submitted resignations or have termination dates approaching. This HR context is provided by configuring an HR data…
Question
You have a Microsoft 365 E5 subscription. You plan to use Microsoft Purview insider risk management. You need to create an insider risk management policy that will detect data theft from Microsoft SharePoint Online by users that submitted their resignation or are near their employment termination date. What should you do first?
Options
- AConfigure Office indicators.
- BConfigure an HR data connector.
- CConfigure a Physical badging connector.
- DOnboard devices to Microsoft Defender for Endpoint.
How the community answered
(36 responses)- A6% (2)
- B78% (28)
- C14% (5)
- D3% (1)
Explanation
To detect data theft correlated with resignation or upcoming employment termination, Microsoft Purview Insider Risk Management must know which users have submitted resignations or have termination dates approaching. This HR context is provided by configuring an HR data connector (option B), which imports employee data (including resignation dates and termination dates) from an HR system into Microsoft 365. Without this HR signal, the policy cannot identify which users are 'departing' and cannot trigger the correct risk indicators. Office indicators (A) and device onboarding (D) are relevant to other policy types or later steps, and the physical badging connector (C) is unrelated to this scenario.
Topics
Community Discussion
No community discussion yet for this question.