A public library system explains Purview capabilities that can block or warn when staff try to exfiltrate sensitive patron data. Which capability fits?

A public library system explaining Purview capabilities that can block or warn when staff try to exfiltrate sensitive patron data should identify Microsoft Purview Data Loss Prevention. DLP provides content-aware detection and policy tips, warnings, or blocks when sensitive patron information is shared outside approved channels, supporting library privacy obligations.

Insider Risk Management correlates behavioral indicators over time to flag risky patterns; it is not the real-time, content-aware mechanism that warns or blocks a specific sensitive share as it happens. Microsoft Purview Information Protection labels patron data and can carry protection settings, but without an active DLP policy evaluating the labeled content, nothing is actually warning or blocking the exfiltration. Communication Compliance reviews message content for policy violations such as harassment; it is not built to warn or block sensitive patron data leaving the tenant the way DLP is.

Exam caveat: Exfiltration warn/block language is a DLP signature on AB-900. Access roles and PIM matter for identity, but they do not analyze message or file content the way DLP does.

Operational check: Deploy DLP locations covering Exchange, SharePoint, and OneDrive used by library staff, include patron PII sensitive info types, enable policy tips, test warn and block scenarios with sample patron data in a non-production library site, and align incident routing to the library privacy officer.