Help dynamically mitigate risks with Adaptive Protection

Adaptive protection in Microsoft Purview uses machine learning to identify the most critical risks and proactively and dynamically apply protection controls from:

• Microsoft Purview Data Loss Prevention (DLP)
• Microsoft Purview Data Lifecycle Management (preview)
• Microsoft Entra Conditional Access (preview)

Integration with data loss prevention, data lifecycle management, and Conditional Access can help organizations automate their response to insider risks and reduce the time required to identify and remediate potential threats. By leveraging the capabilities of all four solutions, organizations can create a more comprehensive security framework that addresses both internal and external threats.

Adaptive protection helps mitigate potential risks by using:

• Context-aware detection. Helps identify the most critical risks with ML-driven analysis of both content and user activities.
• Dynamic controls. Helps enforce effective controls on high-risk users while others maintain productivity.
• Automated mitigation. Helps to minimize the impact of potential data security incidents and reduce admin overhead.

Adaptive protection dynamically assigns appropriate data loss prevention, data lifecycle management, and Conditional Access policies to users based on the insider risk levels defined and analyzed by the machine learning models in insider risk management. Policies become adaptive based on user context, ensuring that the most effective policy, such as blocking data sharing through data loss prevention or blocking application access through Conditional Access, is applied only to high-risk users while low-risk users maintain productivity. Data loss prevention and Conditional Access policy controls constantly adjust, so when a user's insider risk level changes, an appropriate policy is dynamically applied to match the insider new risk level. In the case of data lifecycle management, insider risk management detects Elevated risk level users and preserves their deleted data for 120 days using an automatically created data lifecycle management retention label policy.

Watch the following video for a summary of how Adaptive Protection can help identify and mitigate the most critical risks in your organization:

Insider risk levels and preventive controls

With Adaptive Protection, administrators can configure the risk factors or activities for customizable insider risk levels based on your organization's needs. The insider risk levels for Adaptive Protection update continuously and automatically based on the users' risk factors and insights, so when users' data security risks increase or decrease, their insider risk levels are adjusted accordingly. Based on the insider risk levels, data loss prevention policies and Conditional Access policies automatically apply the right level of preventative controls as configured by admins (such as block, block with override, or warning).

For data lifecycle management, the data lifecycle management policy monitors users that are assigned an Elevated risk level by insider risk management Adaptive Protection. When a risky user deletes any content from SharePoint, OneDrive, or Exchange Online, the contents are automatically preserved for 120 days. Admins can contact Microsoft support to restore any preserved content.

Depending on the insider risk management policy assigned in Adaptive Protection, different criteria (users, groups, indicators, thresholds, etc.) are used to determine applicable insider risk levels. Insider risk levels are based on user insights, not solely on the number of instances of specific user activities. Insights are a calculation of the aggregate number of activities and the severity level of these activities.

For example, insider risk levels for User A wouldn't be determined by User A performing a potentially risky activity more than three times. The insider risk levels for User A would be determined by an insight of the aggregate number of activities and risk scores would be assigned to the activity based on the thresholds configured in the selected policy.

Insider risk levels

Insider risk levels in Adaptive Protection define how risky a user's activity is and can be based on criteria such as how many exfiltration activities they performed or whether their activity generated a high severity insider risk alert. These insider risk levels have built-in insider risk level definitions, but these definitions can be customized as needed:

• Elevated risk level: This is the highest insider risk level. It includes built-in definitions for users with high severity alerts, users with at least three sequence insights that each have a high severity alert for specific risk activities, or one or more confirmed high severity alerts.
• Moderate risk level: The medium insider risk level includes built-in definitions for users with medium severity alerts or users with at least two data exfiltration activities with high severity scores.
• Minor risk level: The lowest insider risk level includes built-in definitions for users with low severity alerts or users with at least one data exfiltration activity with a high severity score.

For an insider risk level to be assigned to a user, the number of insights and the severity assigned to the activity need to match the definition for the insider risk level. The number of activities for an insight may be a single activity or multiple activities accruing to the single insight. The number of insights are evaluated for the insider risk level definition, not the number of activities contained in an insight.

For example, suppose the conditions in the insider risk management policy assigned to Adaptive Protection is scoped for identifying downloads from SharePoint sites in your organization. If the policy detects that a user downloaded 10 files from a SharePoint site in a single day that are determined to be high severity, this would count as a single insight that consists of 10 activity events. In order for this activity to qualify for assigning an Elevated risk level to the user, two additional insights (with high severity) would be required for the user. The additional insights may or may not contain one or more activities.

Customizing insider risk levels

Custom insider risk levels allow you to create insider risk levels based on your organization's needs. You can customize criteria that the insider risk level is based on, and then define conditions to control when the insider risk level is assigned to users.

Consider the following examples for using Adaptive Protection together with data loss prevention, data lifecycle management, and Conditional Access policies.

• Data loss prevention policies:
  • Allow users with the Minor risk level or Medium risk level to receive policy tips and education on best practices of handling sensitive data. In this way, you can influence positive behavior changes over time and reduce organizational data risks.
  • Block users with the Elevated risk level from saving or sharing sensitive data to minimize the impact of potential data incidents.
• Data lifecycle management policy:
  • Preserve any SharePoint, OneDrive, or Exchange Online content deleted by a risky user for 120 days. A risky user in this case is a user that has been assigned the Elevated risk level by Adaptive Protection.
• Conditional Access policies:
  • Require Minor risk level users to acknowledge Terms of Use before using an application.
  • Block Medium risk level users from accessing certain applications.
  • Completely block Elevated risk level users from using any applications. Learn more about commonly applied Conditional Access policies

Insider risk level criteria and conditions

Insider risk level criteria and conditions customization can be based on the following areas:

• Alerts generated or confirmed for a user: This option allows you to choose conditions based on the severity level for alerts that are generated or confirmed for a user for the selected insider risk management policy. Conditions for alerts aren't additive and the insider risk level is assigned to a user if one of the conditions is met.
• Specific user activity: This option allows you to choose conditions for activity to detect, its severity, and the number of daily occurrences during the past activity detection window (optional). Conditions for user activity are additive and the insider risk level is assigned to a user only if all the conditions are met.

Past activity detection

This insider risk level setting determines how many days back Adaptive Protection examines to detect whether a user meets the conditions defined by any of the insider risk levels. The default setting is 7 days, but you can choose between 5 and 30 days of previous activity to apply insider risk level conditions. This setting only applies to insider risk levels that are based on a user's daily activity and excludes insider risk levels based on alerts.

The following example illustrates how past activity detection settings and insider risk levels interact to determine if a user's past activity is in-scope:

• Elevated risk level setting: User performs at least three sequences, each with a high severity risk score (67 to 100)
• Past activity detection setting: 3 days

Insider risk level timeframe

This insider risk level setting determines how long an insider risk level remains assigned to a user before it's automatically reset. The default setting is 7 days, but you can choose between 5 and 30 days before resetting the insider risk level for a user.

Insider risk levels also reset for a user when:

• The associated alert for the user is dismissed.
• The associated case for the user is resolved.
• The insider risk level end date is manually expired.

Risk level expiration options

When this option is enabled (it's enabled by default), Adaptive Protection risk levels for a user automatically expire when the associated alert for a user is dismissed or the associated case for the user is closed. If you want to keep the Adaptive Protection risk level for a user even if the alert is dismissed or the case is closed, disable the option.

Permissions for Adaptive Protection

Depending on how you're using insider risk management built-in role groups and role groups for data loss prevention or Conditional Access, you may need to update permissions for administrators, analysts, and investigators in your organization.

The following table describes the permissions required for specific Adaptive Protection tasks.

Learn more about role groups in Microsoft Defender for Office 365 and Microsoft Purview compliance

Configure Adaptive Protection

Depending on the needs of your organization or where you're currently configured with insider risk management, data loss prevention, data lifecycle management, and Conditional Access, you have two options to get started with Adaptive Protection:

• Quick setup
• Custom setup

Quick setup

The quick setup option is the fastest way to get started with Adaptive Protection. With this option, you don't need any pre-existing insider risk management, data loss prevention, data lifecycle management, or Conditional Access policies, and you don't need to pre-configure any settings or features. If your organization doesn't have a current subscription or license that supports insider risk management, data loss prevention, or data lifecycle management, sign up for a Microsoft Purview risk and compliance solutions trial before starting the quick setup process. You can also sign up for a Microsoft Entra trial for Conditional Access.

You can get started by selecting Turn on Adaptive Protection from the Adaptive Protection cards on the Microsoft Purview portal home page or the data loss prevention Overview page. You can also get started with the quick setup process by going to Insider risk management > Adaptive protection > Dashboard > Quick setup.

Here's what is configured when you use the quick setup process for Adaptive Protection:

Once the quick setup process is started, it can take up to 72 hours before analytics are completed, the associated insider risk management, data loss prevention, data lifecycle management, and Conditional Access policies are created, and you can expect to see Adaptive Protection insider risk levels, data loss prevention, data lifecycle management, and Conditional Access actions applied to applicable user activities. Administrators receive a notification email once the quick setup process is completed.

Custom setup

The custom setup option allows you to customize the insider risk management policy, the insider risk levels, and the data loss prevention and Conditional Access policies configured for Adaptive Protection.

This option also allows you to configure these items before actually enabling the Adaptive Protection connections between insider risk management and data loss prevention. In most cases, this option should be used by organizations that already have insider risk management and/or data loss prevention policies in place.

Complete the following steps to configure Adaptive Protection using the custom setup.

Step 1: Create insider risk management policy

Insider risk levels are assigned to users when a policy assigned in Adaptive Protection either detects user activity or generates alerts that match the insider risk level conditions you define in the next step. If you don't want to use an existing insider risk management policy (selected in Step 2), you must create a new insider risk management policy. Your insider risk management policy for Adaptive Protection should include:

• Users whose activity you want to detect. This can be all users and groups in your organization or just a subset for specific risk mitigation scenarios or testing purposes.
• Activities you consider risky and custom thresholds that influence an activity's risk score. Risky activities might include emailing people outside your organization or copying files to USB devices.

Select Create insider risk policy to launch the new policy wizard. The Data leaks policy template is automatically selected in the wizard, but you can select any policy template.

Step 2: Configure insider risk level settings

Select the Insider risk levels tab. Start by selecting the insider risk management policy you want to use for Adaptive Protection. This can either be the new policy you created in Step 1 or an existing policy or policies that you've already configured.

Next, accept the applicable built-in insider risk level conditions or create your own. Depending on the type of policy you've selected, the insider risk level conditions will reflect the applicable conditions associated with indicators and activities you've configured in the policy.

For example, if you've chosen a policy based on the Data leaks policy template, the built-in insider risk level condition choices apply to indicators and activities available in that policy. If you've selected a policy based on the Security policy violations policy template, the built-in insider risk level conditions are automatically scoped to indicators and activities available in that policy.

Customize an insider risk level for your policy

Select the appropriate tab for the portal you're using. To learn more about the Microsoft Purview portal, see Microsoft Purview portal. To learn more about the Compliance portal, see Microsoft Purview compliance portal.

How insider risk level is assigned if a user is in scope for multiple policies

If a user is in scope for multiple policies, if the user receives alerts of different severity levels, by default, the user is assigned the highest severity level received. For example, consider a policy that assigns an Elevated risk level if users receive a high severity alert. If a user receives a low-severity alert from policy 1, a medium-severity alert from policy 2, and a high-severity alert from policy 3, the user is assigned an Elevated risk level — the level for the highest alert severity received.

Note that insider risk level conditions must be present in selected policies to be detected. For example, if you select the Copy to USB activity to assign a Moderate risk level, but the activity is selected in just one of three selected policies, then only activity from that one policy will assign a Moderate risk level for that activity.​

Step 3: Create or edit a data loss prevention policy

Next, create a new data loss prevention policy (or edit an existing policy) to restrict actions for users who match your insider risk level conditions in Adaptive Protection. Use the following guidelines for your data loss prevention policy configuration:

• You must include the User's insider risk level for Adaptive Protection is condition in your data loss prevention policy. This data loss prevention policy can include other conditions as needed.
• Although you can include other locations in the data loss prevention policy, Adaptive Protection currently supports only Exchange, Microsoft Teams, and devices.

Select Create policy to launch the data loss prevention policy wizard and create a new data loss prevention policy. If you have an existing data loss prevention policy that you'd like to configure for Adaptive Protection, go to Data loss prevention > Policies in the compliance portal and select the data loss prevention policy you'd like to update for Adaptive Protection. For guidance on how to configure a new data loss prevention policy or update an existing data loss prevention policy for Adaptive Protection, see Learn about Adaptive Protection in data loss prevention: Manual configuration.

Step 4: Create or edit a Conditional Access policy

Next, create a new Conditional Access policy (or edit an existing policy) to restrict actions for users who match your insider risk level conditions in Adaptive Protection. Use the following guidelines for your Conditional Access policy configuration:

• On the Conditional Access page where you control access based on signals from conditions, set the Insider risk condition to Yes, and then select an insider risk level (Elevated, Moderate, or Minor). This is the insider risk level that users must have in order for the policy to be enforced.

Select Create policy to launch the Conditional Access policy wizard and create a new Conditional Access policy. If you have an existing Conditional Access policy that you'd like to configure for Adaptive Protection, go to Protection > Conditional Access in the Microsoft Entra admin center and select the Conditional Access policy you'd like to update for Adaptive Protection. For guidance on how to configure a new Conditional Access policy or update an existing Conditional Access policy for Adaptive Protection, see Common Conditional Access policy: Insider risk based policy.

Step 5: Turn on Adaptive Protection

After you've completed all of the previous steps, you're ready to enable Adaptive Protection. When you turn on Adaptive Protection:

• The insider risk management policy starts looking for user activity matching your insider risk level conditions. If detected, the insider risk levels are assigned to users.
• Users who are assigned insider risk levels appear on the Users assigned insider risk levels tab in Adaptive Protection.
• The data loss prevention policy applies protection actions for any user assigned to insider risk levels included in the data loss prevention policy. The data loss prevention policy is added to the Data Loss Prevention tab in Adaptive protection. You can view details about the data loss prevention policy and edit policy conditions from the dashboard.
• The data lifecycle management policy, which is automatically created, applies protection actions for any user assigned to the Elevated risk level. The following message appears with a green background on the Adaptive Protection tab to let users know that proactive data preservation is being applied: "Your organization is also being dynamically protected from users who might potentially delete critical data." The message also provides a link to the data lifecycle management setting where you can turn off the proactive data preservation feature, if desired.
• The Conditional Access policy applies protection actions for any user assigned to insider risk levels included in the Conditional Access policy. The Conditional Access policy is added to the Conditional Access policies tab in Adaptive protection. You can view details about the Conditional Access policy and edit policy conditions from the dashboard.

To enable Adaptive Protection, select the Adaptive Protection settings tab, and then turn Adaptive Protection to On. It may take up to 36 hours before you can expect to see Adaptive Protection insider risk levels and data loss prevention, data lifecycle management, and Conditional Access actions applied to applicable user activities.

Watch the following video on the Microsoft Mechanics channel to see how Adaptive Protection can automatically adjust the strength of data protection based on calculated data security insider risk levels of users.

Manage Adaptive Protection

Once you've enabled Adaptive Protection, and your insider risk management, data loss prevention, and Conditional Access policies are configured, you'll have access to information about policy metrics, current in-scope users, and insider risk levels currently in-scope.

Dashboard

After you've completed either the Quick or Custom setup process, the Dashboard tab in Adaptive protection displays widgets for summary information about user insider risk levels, Conditional Access policies, and data loss prevention policies.

• Users assigned insider risk levels: Displays the number of users for each insider risk level (Elevated, Moderate, and Minor).
• Policies using insider risk levels: Displays the status of policies (Not started or Complete), the type of policy (Conditional Access or Data Loss Prevention), and the number of configured policies for each type of policy. If a policy type hasn't been configured, select Quick setup to configure the policy.

Users assigned insider risk levels

Users that have been assigned an insider risk level in Adaptive Protection appear on the Users assigned insider risk levels tab. You can review the following information for each user:

• Users: Lists the user name. For data loss prevention policies, if the Show anonymized versions of usernames option is selected in insider risk management settings, you'll see anonymized user names. For Conditional Access policies, user names are not anonymized even if the Show anonymized versions of usernames setting is selected.

  Important

  To maintain referential integrity, anonymization of usernames (if turned on) isn't preserved for users from Adaptive Protection who have alerts or activity appear outside insider risk management. Actual usernames will appear in related data loss prevention alerts and the activity explorer.

• Insider risk level: The current insider risk level assigned to the user.

• Assigned to user: The number of days or months that have passed since the user was assigned an insider risk level.

• Insider risk level resets: The number of days until the insider risk level is automatically reset for the user.

  To manually reset the insider risk level for a user, select the user, and then select Expire. This user will no longer be assigned an insider risk level. Existing alerts or cases for this user won't be removed. If this user is included in the selected insider risk management policy, an insider risk level will be assigned again if a triggering event is detected.

• Active alerts: The number of current insider risk management alerts for the user.

• Cases confirmed as violation: The number of confirmed cases for the user.

• Case: The name of the case.

If needed, you can filter users by Insider risk level.

To view detailed insider risk and Adaptive Protection information for a specific user, select the user to open the user details pane. The details pane contains three tabs, User profile, User activity, and Adaptive protection summary. For information about the User profile and User activity tabs, see View user details.

The Adaptive protection summary tab aggregates information in four sections:

• Adaptive protection: This section displays information about the current Risk level, Risk level assigned on, and Risk level reset on for the user.
• Data Loss Prevention policies in scope (dynamic): This section displays all the data loss prevention policies currently in scope for the user and the start and end date for the policy. This is based on the insider risk level for the user and data loss prevention policy configuration for insider risk levels. For example, if a user has activities that have been defined as Elevated risk level for insider risk management policies, and two data loss prevention policies are configured with the Elevated risk level condition, these two data loss prevention policies will be displayed here for the user.
• Conditional Access policies in scope (dynamic): This section displays all the Conditional Access policies currently in scope for the user and the start and end date for the policy. This is based on the insider risk level for the user and Conditional Access policy configuration for insider risk levels. For example, if a user has activities that have been defined as Elevated risk level for insider risk management policies, and a Conditional Access policy is configured with the Elevated risk level condition, the Conditional Access policy will be displayed here for the user.
• Insider risk policy for Adaptive protection: This section displays any insider risk management policy where the user is currently in-scope.

Conditional Access policies

The Conditional Access policies page displays all Conditional Access policies that are using the Insider risk condition. You can review the following information for each policy:

• Policy name: The name of the Conditional Access policy.
• Policy state: The current state of the policy. Values are Active or Inactive.
• Insider risk levels: The insider risk levels included in the Conditional Access policy using the Insider Risk condition. The options are Elevated, Moderate, or Minor.
• Policy status: The current status of the Conditional Access policy. The options are On or Test with notifications.
• Created on: The date the Conditional Access policy was created.
• Last modified: The date the Conditional policy was last edited.

Data Loss Prevention policies

The Data Loss Prevention policies page displays all data loss prevention policies that are using the User's insider risk level for Adaptive Protection is condition. You can review the following information for each policy:

• Policy name: The name of the data loss prevention policy.
• Policy state: The current state of the policy. Values are Active or Inactive.
• Policy location: The locations included in the data loss prevention policy. Currently, Adaptive Protection supports Exchange, Teams, and Devices.
• Insider risk levels: The insider risk levels included in the data loss prevention policy using the Insider risk level for Adaptive Protection is condition. The options are Elevated, Moderate, or Minor.
• Policy status: The current status of the data loss prevention policy. The options are On or Test with notifications.
• Created: The date the data loss prevention policy was created.
• Last modified: The date the data loss prevention policy was last edited.

Tune your insider risk level settings

You may find after reviewing users with insider risk levels that you have too many or too few users that are assigned an insider risk level. You can use two methods to tune your policy configurations to decrease or increase the number of users that are assigned insider risk levels:

• Modify insider risk level settings. You can adjust your thresholds to assign an insider risk level to a user:
  • Increase or decrease the severity of the activity required to assign an insider risk level. For example, if you're seeing too few users with insider risk levels, you can reduce the activity or alert severity.
  • If the insider risk level is based on a specific user activity, increase or decrease the activity occurrences during the detection window. For example, if you're seeing too few users with insider risk levels, you can reduce the activity occurrences.
  • Change what the insider risk level is based on. For example, if you're seeing too many users with insider risk levels, to decrease the number of users, you could assign an insider risk level only if the alert is confirmed.
• Modify policy thresholds. Since insider risk levels are assigned based on policy detections, you can also modify your policy, which will in turn change the requirements to assign a insider risk level. You can modify a policy by increasing or decreasing the policy thresholds that lead to high/medium/low severity activities and alerts.

Disable Adaptive Protection

There may be certain scenarios when you might need to disable Adaptive Protection temporarily. To disable Adaptive Protection, select the Adaptive Protection settings tab and turn the Adaptive Protection to Off.

If Adaptive Protection is turned off after having been on and active, insider risk levels will stop being assigned to users and shared with data loss prevention, data lifecycle management, and Conditional Access, and all existing insider risk levels for users will be reset. After turning Adaptive Protection off, it might take up to 6 hours to stop assigning insider risk levels to user activity and reset them all. The insider risk management, data loss prevention, data lifecycle management, and Conditional Access policies aren't automatically deleted.