Access to Customer Data

Routine reviews of user accounts and their associated privileges and permissions should be conducted to identify overly-permissive accounts, or accounts that are no longer required to be active.

Offering mental health support and conflict resolution programs to
help employees identify and report manipulative behavior in the
workplace

A structured program, including a helpline or other reporting mechanism, designed to assist employees who feel vulnerable, whether due to personal issues, coercion, or extortion. This process allows employees to confidentially raise concerns with trusted teams, such as Human Resources or other qualified professionals. In some cases, it may be appropriate to discreetly share this information with trusted individuals within the Insider Risk Management Program to help prevent and detect insider threats while also providing necessary support to the employee.

Mandatory security awareness training for employees can help them to recognize a range of cyber attacks that they can play a part in preventing or detecting. This can include topics such as phishing, social engineering, and data classification, amongst others.

Microsoft Information Protection (MIP) sensitivity labels are powerful tools for preventing unauthorized access, data leakage, data loss and other types of insider events through classification and protection of sensitive content. When applied to documents, emails, and other content, MIP labels embed metadata that enforces encryption, access control policies, and usage restrictions — all of which persist even if the content is shared or moved outside the organization’s environment. This proactive protection mechanism helps to ensure that data loss, misuse, or regulatory breaches are minimized, regardless of where or how the data is accessed.

Persistent Protection through Azure Rights Management (Azure RMS)
One of the key features of MIP labels is their ability to enforce encryption and access control via Azure Rights Management (Azure RMS). When a document or email is assigned a sensitivity label such as Highly Confidential, it triggers policies that encrypt the file, limiting who can open it and what actions can be performed. For example, a Highly Confidential document might be encrypted so that only authorized users in specific security groups can access it. Additionally, these policies may prevent recipients from forwarding, printing, copying, or even accessing the document offline, ensuring that sensitive data cannot be shared beyond authorized channels.

Automatic and Recommended Labeling
MIP labels also support automatic and recommended labeling. Labels can be automatically applied based on content that is identified as sensitive (such as credit card numbers, Social Security numbers, or intellectual property). This reduces reliance on users to manually select the correct label, ensuring that content is always classified according to its sensitivity level. For example, a file containing financial data or personally identifiable information (PII) may automatically receive a Confidential label, which immediately triggers encryption and access controls. By applying labels automatically, organizations can minimize the risk of human error in classifying sensitive content and ensure that protective measures are consistently applied.

Enforcing Access Governance and User Restrictions
MIP labels are directly integrated with Azure Active Directory (Azure AD) and Microsoft 365 security groups, allowing organizations to enforce access governance. Each label can define the users or groups who are permitted to access certain types of content. For example, a document labeled Confidential may be restricted to a specific department or team, preventing unauthorized users from viewing or editing it. Access to content labeled with higher sensitivity, such as Highly Confidential, can be further restricted to executives or security professionals, ensuring that only authorized individuals can access critical business data. These policies persist even when the content is shared outside the organization or accessed on non-corporate devices.

Blocking Unauthorized Sharing and Transfers
Through integration with Microsoft Defender for Office 365 and Data Loss Prevention (DLP) policies, MIP labels can enforce automatic blocking of unauthorized sharing or transfer of sensitive content. For example, when a document is labeled as Internal Use Only, any attempt to share it externally via email, cloud storage, or external USB devices can be blocked automatically by DLP policies. Labels can also be configured to restrict sharing links to specific people or groups and can enforce expiration on shared links. This ensures that sensitive data remains within the organization and cannot be accessed by unauthorized individuals or systems.

Policy Enforcement in Microsoft Teams and SharePoint
MIP labels are integrated across key collaboration tools like Microsoft Teams and SharePoint, providing seamless protection in the cloud. In these environments, sensitivity labels govern sharing permissions, access rights, and file handling. For instance, if a file is labeled as Confidential, it might be restricted from being shared externally via Teams or SharePoint. These platforms can also prevent file download and sharing for users in unmanaged or non-compliant environments, ensuring that sensitive data cannot be accessed outside the organization's controlled infrastructure. MIP labels also enable policies that enforce restrictions on guest access, preventing external parties from viewing or editing sensitive content unless explicitly permitted.

Blocking Label Downgrades and Enforcing Label Change Justification
To prevent unauthorized downgrading of content labels, MIP provides mechanisms to block label downgrades without proper justification. For example, a user may not be allowed to change a document’s label from Confidential to Public without providing an explicit justification. Such actions are logged and may trigger alerts for review by security teams. This ensures that users cannot bypass sensitive information protection policies by reclassifying content to a lower sensitivity level. Moreover, any label changes are auditable, helping organizations track and monitor potential attempts to circumvent security protocols.

Preventing Exfiltration in Cloud and Endpoint Contexts
MIP labels integrate with Microsoft Defender for Endpoint and Defender for Cloud Apps, providing protection against exfiltration of sensitive data through cloud and endpoint channels. By applying labels to sensitive documents, organizations can enforce controls that restrict their movement across corporate boundaries. For example, when a file labeled Confidential is accessed from an unmanaged device or through a risky application, it may be blocked from being downloaded or printed, preventing potential exfiltration. Additionally, organizations can configure conditional access policies to prevent data access based on the device’s compliance or security status, ensuring that sensitive information is protected even when users access it from external sources.

Training should equip employees to recognize manipulation tactics, such as social engineering and extortion, that are used to coerce actions and behaviors harmful to the individual and/or the organization. The training should also encourage and guide participants on how to safely report any instances of coercion.

Provide a process for all staff members to report concerning and/or suspicious behaviour to the organization's security team for review. An internal whistleblowing process should take into consideration the privacy of the reporter and the subject(s) of the report, with specific regard to safeguarding against reprisals against reporters.

Regulation Awareness Training equips staff with the knowledge and understanding required to comply with legal, regulatory, and policy obligations relevant to their roles. This includes, but is not limited to, export controls, international sanctions, anti-bribery laws, conflict-of-interest rules, antitrust regulations, and data protection requirements.

The training should be customized according to the specific risks of different roles within the organization, ensuring that employees in high-risk areas—such as legal, procurement, sales, finance, engineering, and senior management—receive in-depth education on how to recognize and avoid behaviors that could lead to regulatory violations. Scenarios that could result in inadvertent or intentional breaches should be addressed, alongside practical advice on how to report concerns and escalate issues.

To accommodate varying learning styles and operational needs, Regulation Awareness Training can be delivered through multiple formats:

• eLearning Modules: For general staff, to provide flexible, scalable training on compliance topics, which can be completed at the employee's convenience.
• Instructor-led Sessions: For higher-risk roles or senior management, where more interactive, in-depth training may be necessary to address complex regulatory requirements and nuanced decision-making.
• Scenario-based Workshops: To reinforce learning with real-world examples and role-playing exercises that help employees internalize regulatory concepts.

By fostering a culture of compliance and accountability, Regulation Awareness Training helps minimize the risk of breaches, whether intentional or accidental, and strengthens the organization’s ability to identify, prevent, and respond to regulatory infringements.

A Data Loss Prevention (DLP) solution refers to policies, technologies, and controls that prevent the accidental and/or deliberate loss, misuse, or theft of data by members of an organization. Typically, DLP technology would take the form of a software agent installed on organization endpoints (such as laptops and servers).

Typical DLP technology will alert on the potential loss of data, or activity which might indicate the potential for data loss. A DLP technology may also provide automated responses to prevent data loss on a device.

Microsoft Information Protection (MIP) sensitivity labels are metadata-based security attributes applied to files, emails, and other content within Microsoft 365 environments. MIP sensitivity labels act as a form of document-centric access control, embedding security policies directly into files and emails. By tagging content with persistent metadata that enforces encryption, access restrictions, and visual markings, MIP labels ensure that data protection travels with the document—regardless of where it's stored or shared—providing consistent security across organizational and cloud boundaries. 

MIP labels are centrally defined through the Microsoft Purview compliance portal and persist within the content itself—stored in metadata streams such as Office document custom properties or XML parts. Labels can be applied manually by users or automatically via content inspection rules, data classification policies, or machine learning models. Once applied, labels can enforce a range of protections, including Azure Information Protection (AIP)-based encryption, visual markings (e.g., headers, footers, watermarks), and access restrictions.

Because MIP labels are integrated with Microsoft 365 applications and services, they serve as a powerful mechanism for monitoring and auditing sensitive data handling. Labeling events generate detailed telemetry that can help identify suspicious or non-compliant user behavior, such as:

• Downgrading a file from a more restrictive label (e.g., "Highly Confidential") to a less restrictive one (e.g., "Public") before exfiltration.
• Applying inconsistent labels to similar types of content.
• Bypassing automatic labeling recommendations or ignoring mandatory labeling prompts.
• Accessing or modifying labeled content outside normal working hours or from anomalous locations.

Detection can be implemented across various Microsoft platforms:

• Microsoft Purview (formerly Microsoft 365 Compliance Center) provides audit logs and activity explorer views for label application, modification, and removal.
• Microsoft Defender for Cloud Apps (MCAS) enables near real-time monitoring of MIP label usage across Microsoft 365 and integrated third-party services.
• Microsoft Sentinel can ingest logs from Microsoft Purview, Azure AD, and Microsoft Defender to correlate labeling activity with other insider threat signals.
• Microsoft Defender for Endpoint monitors endpoint behavior, which can be used to identify lateral movement, data access anomalies, or unauthorized label downgrades.
•  

Detection rules can be enriched with user and entity behavior analytics (UEBA), data loss prevention (DLP) events, and identity-based risk signals (e.g., unusual sign-ins or privilege escalations) to increase fidelity and reduce false positives.