Fabrikam’s security team notices that a departing engineer downloaded large volumes of source code from SharePoint, copied data to a personal cloud…

Microsoft Purview Insider Risk Management is the appropriate solution because it is specifically designed to correlate a wide range of user activity signals over time to detect complex and subtle patterns of risky behavior, such as those described. It moves beyond simple content inspection to analyze behavioral context, making it ideal for identifying potential data theft by a departing employee whose actions (large downloads, copying to personal cloud, unusual messages) collectively indicate a threat. The solution also includes built-in case management workflows that can be escalated to eDiscovery (Premium).

The alternative of "just tightening DLP rules" is incorrect because Data Loss Prevention (DLP) is primarily focused on preventing the exfiltration of specific sensitive data types based on content-matching policies. DLP would struggle to identify the malicious intent or the risky pattern of behavior described, as some actions might not trigger a specific DLP rule in isolation. Insider Risk Management analyzes the sequence and context of actions, which is required in this scenario.

1. Microsoft Learn. "Learn about insider risk management". In the "How insider risk management helps manage risk" section

it states

"Insider risk management correlates various signals to identify potential malicious or inadvertent insider risks...".

2. Microsoft Learn. "Insider risk management workflow". This document outlines the "Investigate" and "Act" stages

which include creating a case for an alert and options to escalate to an eDiscovery (Premium) case.

3. Microsoft Learn. "Learn about data loss prevention". This document describes DLP as helping to "identify and protect sensitive items across Microsoft 365 services

" focusing on content inspection rather than behavioral patterns.