Describe Microsoft 365 apps and services →easyMultiple Select

MS-900 Describe Microsoft 365 apps and services Practice Question

Which TWO Microsoft 365 services provide capabilities for insider risk management?

⚠ Common exam trap

Candidates often confuse Microsoft Defender XDR (external threat detection) with insider risk management, or mistakenly think Entra ID's identity protection features cover internal user behavior monitoring, when in fact only Purview Insider Risk Management and Communication Compliance directly address insider risk scenarios.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Microsoft Purview Insider Risk Management

Microsoft Purview Insider Risk Management (option B) is a dedicated service that uses machine learning and behavioral analytics to detect, investigate, and respond to risky user activities such as data theft, policy violations, or unauthorized access. It correlates signals from Microsoft 365 logs, HR data, and user behavior to identify potential insider threats, making it the primary tool for insider risk management.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Microsoft Entra ID
Why it's wrong here
Microsoft Entra ID is a cloud identity and access management service that provides authentication, single sign-on, and conditional access policies. It does not analyze user behavior or monitor internal activity for risk, so it cannot detect insider threats. Insider risk detection requires telemetry from workloads, not identity controls.
✓
Microsoft Purview Insider Risk Management
Why this is correct
Microsoft Purview Insider Risk Management is a dedicated solution designed to detect, investigate, and act on potential internal threats such as data exfiltration or sabotage. It uses machine learning and predefined risk indicators to score user activities across Microsoft 365, enabling security teams to identify subtle patterns of insider misuse. This service directly fulfills insider risk management requirements.
✓
Microsoft Purview Communication Compliance
Why this is correct
Microsoft Purview Communication Compliance is a complementary service that identifies policy violations in emails, Teams chats, and other communications, such as harassment, sharing confidential information, or inappropriate business conduct. While not solely focused on data exfiltration, it plays a key role in insider risk by flagging risky communications that may precede or constitute malicious activity. Its integration with Insider Risk Management strengthens overall threat detection.
✗
Microsoft Intune
Why it's wrong here
Microsoft Intune is an endpoint management solution that provides mobile device management (MDM) and mobile application management (MAM). It enforces device compliance, configuration, and application policies but does not analyze user behavior or detect internal security incidents. Insider risk monitoring requires usage analytics and event correlation, which Intune does not provide.
✗
Microsoft Defender XDR
Why it's wrong here
Microsoft Defender XDR is an extended detection and response platform that consolidates signals from endpoints, email, and identities to identify sophisticated cyberattacks. Its primary focus is defending against external threats, such as malware or account compromise, rather than analyzing trusted users' intentional risky actions. Insider risk detection relies on user-centric behavioral analytics, not threat-centric telemetry, so Defender XDR is not the appropriate service here.

Go deeper

MS-900 Describe Microsoft 365 apps and services Practice Question

Why each option matters

Option-by-option breakdown

Related to this question