Scenario: Ronny leaves with the customer list Scenario. Ronny Insider has handed in his notice. Over ten days he downloads the customer files, lowers a label and tries to email the customer list to his private address. DLP blocks the email, and the DLP match triggers the Insider Risk Management Data leaks policy. Past activity is scored, the risk rises to High and an alert is raised. Adaptive Protection gives Ronny the Elevated level, and stricter DLP rules for devices, Exchange and Teams block his next three attempts: upload to the web, USB and an external Teams chat. An analyst confirms the alert, an investigator works the case with HR and the manager, sends a notice, and resolves the case. W INSIDER RISK MANAGEMENT Scenario: Ronny leaves with the customer list Ada Admin Eli Employee Ronny Insider THE SETUP What is already in place Ronny Insider has two weeks left. Watch what each control sees. MICROSOFT 365 TENANT OUTSIDE THE ORGANIZATION SharePoint Customer site Audit logMicrosoft 365 DLP Insider Risk Management Not in scope TRIGGER · IN SCOPE Alert: High Adaptive Protection: Elevated Private email ronny@freemail.example Microsoft 365 CopilotApproved Risky prompt Web upload File sharing service Devices Exchange Teams External chatTeams, outside guest Customer list Confidential TEN DAYS IN SUMMARY No single control did it all WHAT HAPPENEDWHAT CAUGHT IT Good to know 1/7 INSIDER RISK MANAGEMENT Scenario: Ronny leaves with the customer list Ronny has handed in his notice and wants to take the customer list with him. We follow ten days, from the first download to a resolved case, and see what each control catches along the way. informasjonsbeskyttelse.no