HR flags unusual mass downloads by a departing public-works employee, while another team only wants to stop Social Security numbers from leaving in email. How should the city distinguish insider risk from DLP?
Select an answer to reveal the explanation.
Short Explanation
One story is about what people are doing that looks sketchy. The other is about what sensitive data is trying to leave. Insider risk watches behavior; DLP watches the content.
Full Explanation
HR’s unusual mass downloads by a departing public-works employee point to insider risk (risky user behavior), while another team stopping SSNs from leaving in email points to DLP (sensitive-content sharing controls). Distinguishing behavior-centric insider risk from content-centric DLP keeps municipal compliance tooling mapped correctly when both may be needed on the same incident.
Insider risk does not only print badges, and DLP does not only rename SharePoint sites. DLP does not replace Entra ID, and insider risk does not replace Teams Phone. Neither term means an Autopilot deployment ring.
Exam caveat: a single departure incident can trigger both—an insider risk alert for bulk download behavior and DLP incidents if sensitive types leave—so playbooks should coordinate, not pick only one forever. Operational check: review one departure tabletop with both an insider risk policy and a DLP policy in scope, and document which team owns each alert type. In municipal Microsoft 365 fundamentals scenarios, always map the business need to the named capability, reject distractors that describe a different pillar, and verify the control in the admin portal before telling leadership the risk is closed.