# Adaptive Protection is enabled in data loss prevention policies

With Adaptive Protection, organizations can apply the right controls to the right users based on the risk of their behavior.

Source: https://maester.dev/docs/tests/ZTA.35032

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

## Overview

With Adaptive Protection, organizations can apply the right controls to the right users based on the risk of their behavior.

Adaptive Protection in Microsoft Purview integrates Microsoft Purview Insider Risk Management machine learning with Microsoft Purview Data Loss Prevention (DLP). When insider risk identifies a user who is engaging in risky behavior, they're dynamically assigned to an inside risk level. Then Adaptive Protection can automatically create a DLP policy to help protect the organization against the risky behavior that's associated with that inside risk level. As users insider risk levels change in insider risk management, the DLP policies applied to users can adjust.

## Remediation

- [Help dynamically mitigate risks with Adaptive Protection](https://learn.microsoft.com/purview/insider-risk-management-adaptive-protection?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)

## Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```

Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.

<details>
<summary>About this check</summary>

| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Medium |
| Pillar | Data, AI |
| Category | Data Loss Prevention (DLP) |
| Product | [Purview](/docs/tests/products/purview) |
| Feature | Insider risk management |
| Area | Data protection |
| ATT&CK | [T1567](/docs/tests?mitre=T1567) Exfiltration Over Web Service |
| Licence | EXCHANGE_S_ENTERPRISE |
| Tenant | Workforce |

Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.

</details>

<p class="mt-ms-note not-content"><svg class="mt-ms-note__logo" viewBox="0 0 21 21" aria-hidden="true"><rect width="10" height="10" fill="#f25022"/><rect x="11" width="10" height="10" fill="#7fba00"/><rect y="11" width="10" height="10" fill="#00a4ef"/><rect x="11" y="11" width="10" height="10" fill="#ffb900"/></svg><span>A Microsoft check, part of the <a href="/docs/tests/packs/zero-trust-assessment">Zero Trust Assessment</a> pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, <a href="/docs/tests/packs/zero-trust-assessment#licence">MIT licence</a>.</span></p>
