Most DLP policies treat every user the same: strict rules slow everyone down, loose rules let a risky user walk out with data. Adaptive Protection in Microsoft Purview lets Insider Risk Management give a user an insider risk level, and DLP, Conditional Access and data lifecycle management apply stronger controls only while that level lasts. Below: how levels work, quick and custom setup, and how to test before anyone is blocked.
Status (October 2026): Microsoft's Adaptive Protection page still marks the data lifecycle management and Conditional Access integrations as preview; the DLP integration isn't marked as preview. Re-check the page before you rely on the preview parts.
How Adaptive Protection works#
The Insider Risk Management policies you select for Adaptive Protection watch activity and raise alerts. Adaptive Protection turns those insights into an insider risk level: Elevated, Moderate or Minor. Levels aren't alert severities (Low, Medium, High); they follow definitions you can customize. The level is shared with:
- DLP: the rule condition Insider risk level for Adaptive Protection is (Exchange, Teams and Devices locations only).
- Conditional Access: the Insider risk condition.
- Data lifecycle management: content an Elevated user deletes from SharePoint, OneDrive or Exchange Online is preserved for 120 days; restores go through Microsoft support.
| Level | Built-in definition (you can customize it) | What quick setup uses |
|---|---|---|
| Elevated | High severity alerts, at least three sequence insights each with a high severity alert, or one or more confirmed high severity alerts | At least three high severity exfiltration sequences |
| Moderate | Medium severity alerts, or at least two exfiltration activities with high severity scores | At least two high severity activities (some download types excluded) |
| Minor | Low severity alerts, or at least one exfiltration activity with a high severity score | At least one high severity activity (some download types excluded) |
A level is based on alerts generated or confirmed for the user (any condition is enough) or on specific user activity (activity, severity and daily occurrences must all match). Insights are counted, not events: 20 files downloaded from SharePoint in one day is one insight. Past activity detection sets how far back activity-based levels look; Insider risk level timeframe sets how long a level lasts. Both default to 7 days (range 5 to 30). A level also ends when an admin expires it and, by default, when the alert is dismissed or the case is resolved. Across several policies, the highest severity wins.
Prerequisites and permissions#
- Insider Risk Management must be available in your tenant (Microsoft says it isn't available for US Government cloud programs). Check licensing via Microsoft's Adaptive Protection page.
- Devices must be onboarded to endpoint DLP (onboarding guide). Device rules also need advanced classification scanning and protection or the File type is condition.
- Scoped admins can't run quick setup.
| Task | Role group or role |
|---|---|
| Configure Adaptive Protection | Insider Risk Management or Insider Risk Management Admins |
| DLP policies with the risk level condition | Compliance Administrator, Compliance Data Administrator, DLP Compliance Management or Global Administrator |
| Conditional Access policies with the condition | Conditional Access Administrator, Security Administrator or Global Administrator |
| View users' assigned levels | Insider Risk Management, Insider Risk Management Analysts or Insider Risk Management Investigators |
Without the role group, the matching tab is hidden on the Adaptive protection page.
Option 1: quick setup#
In the Microsoft Purview portal, go to Insider Risk Management › Adaptive protection › Dashboard › Quick setup, or select Turn on Adaptive Protection on the portal home page or the DLP Overview page. It creates:
- Adaptive Protection policy for Insider Risk Management (Data leaks template, all users and groups) and the levels above.
- Adaptive Protection policy for Teams and Exchange DLP: Elevated users are blocked from sharing with people outside the organization; Moderate and Minor are audited. Both rules show a policy tip.
- Adaptive Protection policy for Endpoint DLP: for Word, spreadsheet, presentation, archive and mail files, Elevated users are blocked from USB, network share, clipboard, print, restricted cloud service domains, unallowed browsers and restricted apps; Moderate and Minor are audited. Notifications are off.
- A report-only Conditional Access policy blocking Elevated users from Office 365 apps, plus the 120-day data lifecycle management policy.
Both DLP policies start in simulation mode. Setup takes up to 72 hours and ends with an admin email; turning Adaptive Protection off before then can leave policies in error.
Option 2: custom setup#
- Insider risk policy. Select Create insider risk policy (Data leaks is preselected; any template works) and scope it to a pilot group first (setup guide).
- Levels. On Adaptive protection › Insider risk levels, pick the policy and Edit each level: Alert generated or confirmed for a user or Specific user activity.
- DLP policy. In Data loss prevention › Policies, add Insider risk level for Adaptive Protection is to a policy for Exchange, Teams or Devices. A sensible pattern: Elevated block, Moderate block with override, Minor policy tip (DLP policy design).
- Conditional Access. In the Microsoft Entra admin center, under Conditions › Insider risk set Configure to Yes and select Elevated; choose Grant › Block access, start in Report-only and exclude emergency access accounts.
- Turn it on on the Adaptive Protection settings tab. Allow up to 36 hours before levels and actions apply.
Connect-IPPSSession
Get-DlpCompliancePolicy | Where-Object Name -like "Adaptive Protection*" |
Format-Table Name, Mode, DistributionStatusGood is DistributionStatus Success; Mode shows test or enforced.
Test and verify#
- With a pilot account, perform activities your levels count, such as copying Office files to USB.
- On Users assigned insider risk levels, open the user. The Adaptive protection summary tab shows the level, its assigned and reset dates, and the DLP and Conditional Access policies in scope.
- Check DLP alerts and activity explorer (investigation guide) and the report-only result in the sign-in log (report-only guide).
- Select the user and choose Expire: the level clears and the policies drop out of scope; alerts and cases stay.
- Then move DLP out of simulation (simulation to enforcement) and Conditional Access to On.
Once enforced, an Elevated user gets DLP blocks and policy tips in Outlook and Teams, device blocks (quick setup leaves device notifications off; turn them on so users know why) and a Conditional Access block at sign-in (reading the block). See the DLP messages quick reference.
Tips and gotchas#
- Privacy: Insider Risk Management can pseudonymize names, but DLP alerts, activity explorer and Conditional Access show real names; brief your privacy team.
- Overlapping device policies: with an Adaptive Protection device policy and another device DLP policy, only the most restrictive actions apply.
- Tuning: too many users at a level? Base it on confirmed alerts or raise severity and occurrences. Too few? Lower them.
- Turning it off resets all levels within up to six hours; the policies stay until you remove them. Turning off Adaptive protection in Data Lifecycle Management deletes only the retention policy.
