A security team has configured Microsoft Purview Adaptive Protection to dynamically adjust DLP policy enforcement based on a user's current insider risk level. When a user's insider risk score increases to 'Elevated,' their Copilot interactions should be restricted to prevent sensitive data from being included in prompts. How does Adaptive Protection achieve this?

The correct choice is the one that says Adaptive Protection assigns the user an 'Elevated' risk level in Insider Risk Management, which is shared with DLP policies; the DLP policy with an Adaptive Protection condition applies stricter controls, such as block actions, for users at elevated risk. Microsoft Purview Adaptive Protection creates a dynamic bridge between Insider Risk Management and Data Loss Prevention. Insider Risk Management continuously evaluates user behavior and assigns risk levels: Minor, Moderate, and Elevated. These risk levels are exposed to DLP policies through Adaptive Protection conditions. The DLP policy configured with an Adaptive Protection condition can apply different enforcement actions based on the user's current risk level. For example, it can apply a 'Block with override' or 'Block' action for Elevated risk users in Copilot, where lower-risk users would only see an audit or warning. The claim that Adaptive Protection increases the Conditional Access sign-in risk threshold for the user is wrong because Adaptive Protection integrates with DLP, not Conditional Access; sign-in risk is an Entra ID Protection concept. The claim that Adaptive Protection locks the user's Copilot license until the risk level decreases is wrong because Adaptive Protection does not revoke licenses; it adjusts DLP policy enforcement. The claim that Adaptive Protection sends an automatic email to the user's manager requesting review of their Copilot activity is wrong because sending email notifications is a separate Insider Risk Management action, not the Adaptive Protection mechanism that dynamically adjusts DLP controls.