The scenario describes a need to detect complex patterns of potential IP theft by correlating various user activities over time, such as file access, data exfiltration, and HR signals like resignation. Microsoft Purview Insider Risk Management is designed for this exact purpose. It uses machine learning templates to analyze signals from across Microsoft 365, correlate them into potential risks, and generate alerts for investigation. It also includes built-in privacy features like pseudonymization to protect user identities during the initial review phase.

A. Communication compliance focuses on scanning user communications (email, Teams) for specific policy violations, not correlating broad user activities like file exports or HR data.

B. eDiscovery (Premium) is a reactive tool used to collect, review, and export data for legal investigations after an incident, not for proactive risk detection.

D. A Microsoft Purview Audit retention policy only governs how long audit logs are stored; it does not analyze the logs to proactively identify or correlate risky behaviors.

1. Microsoft Learn. (2024). Learn about Microsoft Purview Insider Risk Management. This document states

"Insider risk management correlates various signals to identify potential malicious or inadvertent insider risks

such as IP theft

data leakage

and security violations."

2. Microsoft Learn. (2024). Investigate insider risk management activities. Under the section "User activity in content explorers

" it describes how policies can be triggered by signals like "User resignation or termination date." The "Privacy" section also details the pseudonymization feature.