Microsoft Purview Insider Risk Management is specifically designed to detect, investigate, and act on malicious and inadvertent insider risks. The scenario describes a classic indicator of potential data theft: a departing employee downloading an unusual volume of confidential files outside of normal hours. Insider Risk Management uses signals from Microsoft 365 and other sources to identify such anomalous activities, flags them for review, and provides tools for investigation and response, directly addressing the described threat.

A. Data Access Governance (DAG) reports provide insights into data access permissions but are not primarily designed for real-time detection of anomalous behavioral patterns.

C. Compliance Manager is a tool for assessing and managing an organization's compliance posture against regulations and standards, not for detecting specific user risk activities.

D. DSPM for AI is focused on securing data flows within AI workloads, which is not relevant to an employee downloading files from OneDrive.

1. Microsoft. (2024). Learn about insider risk management. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/insider-risk-management. (The overview section explicitly mentions detecting "data theft by departing employees" as a key use case.)

2. Microsoft. (2024). Investigate insider risk management activities. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/insider-risk-management-investigate. (This document describes how the solution uses indicators and policies to detect risky activities like "downloading files from SharePoint.")