Data Protection and Governance for Microsoft 365 and Copilot · Topic 5 of 6
Insider Risk, DLP Alerts, Communication Compliance and DSPM for AI
AB-900: review Insider Risk alerts, respond to DLP alerts, find Communication Compliance violations and manage AI activity with DSPM for AI.
- 5 min
- Insider Risk Management flags risky user behavior patterns, shown as alerts with severity.
- DLP alerts are reviewed in the Purview portal. Tune policies when there are false positives.
- Communication Compliance puts flagged messages in a queue for reviewers.
What it is
Earlier pages explained what each Purview solution is for. This page is about the work an administrator or reviewer does with each one: reading the alerts, triaging them and acting. All four use the same pattern: a policy detects something, an alert or flagged item appears, and a person reviews it.
How it works
Identify risks with Insider Risk Management
Insider Risk Management policies are created from templates, such as data theft by departing users, data leaks and risky AI usage. The solution gathers signals from activity like downloads, sharing, copying to devices and HR events. It scores them into risk levels.
- The Alerts page lists users whose activity matched a policy, with a severity.
- The reviewer opens an alert to see the activities that led to it.
- The reviewer then confirms it and creates a case, or dismisses it.
User names are pseudonymized by default so reviewers are not biased. The point to remember is that the solution reports risky patterns of behavior, not single events.
Respond to DLP alerts
A DLP policy matches sensitive content in a location. Depending on its rules it blocks the action, shows a policy tip, lets the user override with a business reason, and can send an alert.
| Step | What you do |
|---|---|
| View | Open the DLP alerts view in the Purview portal and sort by severity |
| Investigate | See the policy, the rule that matched, the user, the content type and the action taken |
| Respond | Mark the alert status, assign it, tune the policy if it was a false positive |
Policy tips teach users in the moment. If many alerts are false positives, the answer is to tune the policy conditions, not to turn DLP off.
Identify violations with Communication Compliance
Communication Compliance policies scan messages for conditions such as inappropriate language, sensitive information, or regulatory risks. Matching messages show up in a Pending queue under the policy.
- A reviewer reads the message with its context.
- The reviewer picks Resolve, or Escalate to another reviewer, or sends a notice to the user, or raises a case with Insider Risk Management.
- Reviewers are limited to people given a reviewer role, which protects privacy.
It also covers Microsoft 365 Copilot interactions, so a policy can flag prompts and responses that break conduct rules.
Discover and manage AI activity with DSPM for AI
DSPM for AI is the place to see how Copilot, agents and other AI apps are used with your data.
| Area | What it provides |
|---|---|
| Reports and AI activity | Charts of AI interactions by app, user and sensitive data involved |
| Activity explorer | Detailed events such as AI interaction, with the sensitive types involved |
| Apps and agents | A view of AI apps and agents in use and their data access |
| Data risk assessments | Checks of SharePoint sites for oversharing, with a default weekly assessment of the most used sites |
| Recommendations and policies | One click policies such as detecting risky AI use and protecting data in prompts |
To manage, you activate recommended policies, review reports after they gather data, and follow guidance to fix oversharing. Allow time after activating a policy before results appear. Microsoft is moving this experience into a newer Data Security Posture Management page, with the classic DSPM for AI view being replaced. The tasks stay the same.
A worked example
An analyst opens Insider Risk Management and sees a high severity alert: a user who gave notice has downloaded hundreds of files. She reviews the activity timeline and confirms the alert. Next, she opens DLP alerts and finds many matches for a rule that fires on harmless internal emails, so she tunes the rule. A Communication Compliance reviewer resolves a Teams message flagged for harassment. Last, the admin reads DSPM for AI reports and finds Copilot is surfacing files from an overshared site, so she starts a data risk assessment follow up.
How the exam asks about this
- "Which tool shows a user with unusual file downloads before leaving?" Insider Risk Management.
- "Policy tips and an alert show that a user tried to email card numbers. Which solution is it?" DLP.
- "Where do you review and monitor how users interact with Copilot and which sensitive data was involved?" DSPM for AI.
What to remember for the exam
- Insider Risk Management flags risky user behavior patterns, shown as alerts with severity.
- DLP alerts are reviewed in the Purview portal. Tune policies when there are false positives.
- Communication Compliance puts flagged messages in a queue for reviewers.
- DSPM for AI offers reports, activity explorer, apps and agents, and data risk assessments.
- All four need a person to review the result.
Insider Risk Management does not read message text. If the question is about inappropriate language in messages, the answer is Communication Compliance.
Common mistakes
Mixing up who gets the alert. DLP warns the user and may alert an admin. Insider Risk Management alerts reviewers about a user's behavior.
Expecting DSPM for AI to block actions by itself. It reports and recommends policies. Blocking comes from DLP and other policies it helps you create.
Disabling a noisy policy. The fix for false positives is tuning, not removal.
Check yourself
Which solution queues flagged messages for a reviewer to resolve or escalate?
Communication Compliance.
What should you do when a DLP rule produces many false positives?
Tune the policy conditions rather than turning it off.
Which Purview area gives reports on Copilot and agent activity and data risk assessments for oversharing?
DSPM for AI.
Topic 5 of 6 in Data Protection and Governance for Microsoft 365 and Copilot
Test yourself on Data Protection and Governance for Microsoft 365 and Copilot
The full Microsoft AB-900 question bank has 499 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.