Adaptive Protection Adaptive Protection lets Insider Risk Management assign users an insider risk level: Elevated, Moderate or Minor. DLP, Conditional Access and Data Lifecycle Management use the level to apply stricter controls to the few users who are risky, while everyone else works as usual. Quick setup creates an insider risk policy, DLP policies for Teams and Exchange and for devices in simulation mode, a Conditional Access policy in report-only mode and a retention policy. Ronny is blocked from copying a file to USB, Eli is not. W INSIDER RISK MANAGEMENT Adaptive Protection Ada Admin Eli Employee Ronny Insider ADAPTIVE PROTECTION Stricter rules, only for the risky few THE DLP RING SO FAR The same rules for everyone, no matter who they are. WITH ADAPTIVE PROTECTION Users IRM flags as risky get stricter rules automatically. Everyone else works as before. Protection follows the person's risk, not only the content. INSIDER RISK LEVELS Alert severity becomes a risk level DATA LOSS PREVENTION A DLP rule that knows the user Microsoft Purview Adaptive Protection Adaptive Protection settings When turned on, Adaptive Protection detects users who match yourdefined insider risk levels. If those risk levels are included as a conditionof a Data Loss Prevention policy or a Conditional Access policy, thepolicy will apply the configured actions to that user's activity. Pseudonymization of usernames (if turned on) isn't preserved for usersfrom Adaptive Protection who have alerts or activity appear outsideInsider Risk Management. Adaptive Protection Off On Adaptive Protection Summary of current policies being used for Adaptive Protection and userscurrently protected by policies due to their assigned insider risk levels. Users assigned insider risk levels Elevated risk0 Moderate risk0 Minor risk0 Policies using insider risk levels StatusTypePolicies CompleteConditional Access1 policy CompleteData Loss Prevention1 policy THE USER EXPERIENCE Same file, same USB stick, two outcomes Eli and Ronny both copy the customer list to USB. EliNo insider risk level Allowed by the usual rules RonnyElevated Blocked Seven days later, nothing new Level resets The level also resets when the alert is dismissed or the case is resolved. Good to know 1/7 INSIDER RISK MANAGEMENT Adaptive Protection The DLP ring treats everyone the same. Adaptive Protection lets Insider Risk Management tighten the rules for the few users who are risky, automatically, while everyone else works as before. informasjonsbeskyttelse.no