This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
A user downloads 15 files from SharePoint in one day, all classified as high severity. Your elevated risk level requires three high severity insights. Does this user qualify?
No. The 15 downloads count as one insight, so the user needs high severity activity on at least two more days.
Yes. 15 high severity events exceed the threshold of three.
It depends on whether the downloads are from the same site or different sites.
You want to assign elevated risk only when a user performs multiple high severity activities across several days, not based on a single alert. Which condition type should you use?
Alerts generated or confirmed, filtered to high severity.
Either type works, since both evaluate daily occurrences the same way.
Specific user activity, with high severity and a multi-day occurrence threshold.
Your organization has Insider Risk Management and DLP policies already configured. You're deploying Adaptive Protection and need those existing policies to stay intact. Which setup path should you choose?
Quick setup, because it detects and integrates with existing policies.
Custom setup, so you can select your existing policies and configure each component individually.
Quick setup first, then switch to custom setup to adjust.
An elevated-risk user is sharing sensitive files and also accessing cloud apps they no longer need. You want to block the sharing and restrict the app access. How many enforcement integrations do you need?
One. A DLP policy can handle both file sharing and application access.
One. A Conditional Access policy can handle both application access and file sharing.
Two. DLP for the file sharing, Conditional Access for the application access.
Adaptive Protection has been running for six months. Your compliance team now wants to preserve content deleted by elevated-risk users. What do you need to do?
Opt in to the data lifecycle management (DLM) policy from the Adaptive Protection settings.
Nothing. Data Lifecycle Management preservation is enabled by default for all Adaptive Protection deployments.
Disable Adaptive Protection, re-enable it, and DLM will be included in the new setup.
You must answer all questions before checking your work.
Was this page helpful?
Need help with this topic?
Want to try using Ask Learn to clarify or guide you through this topic?