How to allow list a domain in an Insider Risk Management Policy

Question

Using Purview, Insider Risk Management, Policy Creation, how do I allow list an internal SharePoint domain?

Currently uploads to the internal "mycompany.sharepoint.com" appear as "Activity: File uploaded to cloud". I would like to edit the policy so only uploads to other company's clouds trigger an alert.

Thanks!

Answer 1

@Knight, Kenneth - Thanks for the question and using MS Q&A platform.

Using Purview does not have a feature for Insider Risk Management Policy Creation. Purview is a data governance service that helps you discover and manage your data. It provides a unified and integrated experience to discover, understand, and manage your data.

However, Microsoft 365 Insider Risk Management is a separate service that helps organizations identify and mitigate insider risks. To allow list an internal SharePoint domain in an Insider Risk Management Policy, you can follow these steps:

1. Go to the Microsoft 365 compliance center (https://compliance.microsoft.com/) and sign in with your admin credentials.
2. Click on "Insider risk" in the left-hand menu.
3. Click on "Policies" and then click on "Create policy".
4. Give your policy a name and description, and then select the type of policy you want to create (e.g., Communication policy, Activity policy, etc.).
5. Under "Policy settings", select the SharePoint domain you want to allow list. You can do this by adding the domain to the "Allowed domains" list.
6. Save your policy.

Once you have created your policy, it will be applied to all users in your organization. If a user uploads a file to the allowed SharePoint domain, it will not trigger an alert.

I hope this helps! Let me know if you have any further questions.