Municipal courts IT suspects a departing clerk may be stealing case files and wants the Purview capability aimed at insider data-theft risk. Which choice fits?

Municipal courts IT that suspects a departing clerk may be stealing case files and wants the Purview capability aimed at insider data-theft risk should choose Microsoft Purview Insider Risk Management for potential data theft by departing users. That solution is designed to detect and investigate potentially malicious or inadvertent insider activities, including exfiltration patterns associated with employment departure in sensitive environments such as courts.

Communication Compliance targets risky or inappropriate communications such as harassment, not behavioral patterns around a departing employee's data access. Data Loss Prevention alone can catch specific sensitive content leaving through monitored channels, but it does not correlate that activity with departure context and broader behavioral indicators the way Insider Risk Management does. eDiscovery is built to search and hold content for legal matters after the fact; it is not a proactive detection capability for insider data-theft risk.

Exam caveat: Departing-user data theft risk language points to Insider Risk Management. Conditional Access remains important for access control but is not the Purview insider-risk workload. Cosmetic Teams/M365 features are distractors.

Operational check: Enable and tune Insider Risk Management policies for courts case-file repositories, investigate the departing clerk’s alert timeline (downloads, sharing, USB/cloud indicators if configured), coordinate with court administration and legal, revoke access, and export case notes for HR/disciplinary or law-enforcement follow-up as required.