Adaptive Protection is enabled in data loss prevention policies
Overview
Section titled “Overview”With Adaptive Protection, organizations can apply the right controls to the right users based on the risk of their behavior.
Adaptive Protection in Microsoft Purview integrates Microsoft Purview Insider Risk Management machine learning with Microsoft Purview Data Loss Prevention (DLP). When insider risk identifies a user who is engaging in risky behavior, they’re dynamically assigned to an inside risk level. Then Adaptive Protection can automatically create a DLP policy to help protect the organization against the risky behavior that’s associated with that inside risk level. As users insider risk levels change in insider risk management, the DLP policies applied to users can adjust.
Remediation
Section titled “Remediation”Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Medium |
| Pillar | Data, AI |
| Category | Data Loss Prevention (DLP) |
| Product | Purview |
| Feature | Insider risk management |
| Area | Data protection |
| ATT&CK | T1567 Exfiltration Over Web Service |
| Licence | EXCHANGE_S_ENTERPRISE |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.