Parks and recreation leaders want signals when staff mass-download resident files shortly before leaving city employment. Which Purview capability fits?

Parks and recreation leaders who want signals when staff mass-download resident files shortly before leaving city employment should use Microsoft Purview Insider Risk Management for risky insider activity patterns. Insider Risk Management correlates indicators such as unusual download volume, sequential access, and employment change signals to highlight potential data theft or inadvertent risky behavior around departure.

Data Loss Prevention can detect sensitive content being moved or shared, but on its own it does not correlate download volume with HR departure signals the way Insider Risk Management's behavioral and contextual indicators do. Information Protection classifies resident files with sensitivity labels, but it does not analyze file download volume or departure timing. Audit retains records of resident file download activities after the fact, but it does not proactively surface a risky departure-related download pattern the way a configured Insider Risk Management policy does.

Exam caveat: Mass download near resignation maps to Insider Risk Management, not DLP alone (though DLP may complement) and not collaboration cosmetic settings. AB-900 tests the insider-risk family name for departure-related exfiltration patterns.

Operational check: Configure an Insider Risk Management policy for data theft / departing user indicators scoped to parks and recreation, ensure HR connector or departure signals are available per city process, triage alerts for mass downloads, preserve evidence with legal hold if needed, and coordinate revocation of access promptly.