SC-401 practice question 8 of 25

You have a Microsoft 565 E5 subscription. You plan to use Microsoft Purview insider risk management. You need to create an insider risk management…

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Implement information protection

You have a Microsoft 565 E5 subscription. You plan to use Microsoft Purview insider risk management. You need to create an insider risk management policy that will detect data theft from Microsoft SharePoint Online by users that submitted their resignation or are near their employment termination date. What should you do first?

Answer options

Correct Answer:

Explanation

The core requirement is to create a policy that specifically targets users based on their employment status (resignation or termination). This information resides in an organization's Human Resources (HR) system. Microsoft Purview Insider Risk Management uses an HR data connector to import these critical events, such as resignation dates and termination dates. This data acts as the primary "triggering event" for policies like "Data theft by departing users." Without this connector, the system cannot identify which users are departing and, therefore, cannot apply the policy as intended.

Why Incorrect

B. Configure Office indicators: Office indicators (like SharePoint activity) are signals of what a user is doing, not who the user is in terms of employment status. This is configured later, but the HR data is needed first to trigger the policy.

C. Configure a Physical badging connector: This connector imports data about physical access. While a useful signal, it is not the source for the required resignation or termination date information specified in the scenario.

D. Onboard devices to Microsoft Defender for Endpoint: This provides endpoint activity signals. Similar to Office indicators, this detects risky actions but does not provide the initial HR-based trigger (employment status) required by the policy.

References

1. Microsoft Learn. (2024). Get started with insider risk management. "To enable user-related signals for insider risk management policies

you'll need to configure a Microsoft 365 HR data connector. This connector is required to import resignation and termination date information from your organization's HR systems." This is listed as a prerequisite step before creating policies that depend on these triggers.

URL: https://learn.microsoft.com/en-us/purview/insider-risk-management-get-started#step-3-optional-but-recommended-configure-policy-indicators-and-connectors

2. Microsoft Learn. (2024). Create and manage insider risk management policies. When describing the "Data theft by departing users" policy template

the documentation states

"This policy template requires that you've configured the Microsoft 365 HR data connector to import user termination or resignation date information."

URL: https://learn.microsoft.com/en-us/purview/insider-risk-management-policies#policy-templates

3. Microsoft Learn. (2024). Set up a connector to import HR data. "You can set up a data connector in the Microsoft Purview compliance portal to import human resources (HR) data related to user's employment status... This HR data can then be used by the Data theft by departing users... insider risk management policy template to detect risky user activities."

URL: https://learn.microsoft.com/en-us/purview/import-hr-data

Question 8 of 25

Question breakdown

Tests: Configure insider risk management prerequisites
Difficulty: Easy

Key idea: The 'Data theft by departing users' template relies on resignation and termination dates imported through the HR data connector as its triggering event.

How to reach the answer

The policy must target users who have resigned or are near termination.
Employment status lives in the HR system, not in Microsoft 365 activity signals.
Insider risk management brings in that data through the HR data connector, which supplies the trigger for the departing-users template.
Office indicators and device signals only describe what users do, so they can be configured later; the HR connector comes first.

Each option

ACorrect. The HR connector imports resignation and termination dates, which are the triggering events this policy depends on.
BIncorrect. Office indicators capture SharePoint activity but cannot tell which users are departing.
CIncorrect. Physical badging data covers building access and contains no employment dates.
DIncorrect. Device onboarding adds endpoint signals, but the scenario is about SharePoint and needs HR-based triggers first.

Common trap: Picking Office indicators because the data theft happens in SharePoint, without recognizing that the policy cannot trigger until departure dates are known.

In practice: Security teams work with HR to export employee termination data as CSV files and schedule uploads through the HR connector before enabling departing-user policies.

Remember: Departing-user insider risk policies start with the HR data connector.

Official documentation: Set up a connector to import HR data · Insider risk management policies

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free SC-401 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test