Describe insider risk management in Microsoft Purview

  • 7 minutes

Microsoft Purview Insider Risk Management is a compliance solution that helps minimize internal risks by enabling you to detect, investigate, and act on risky and malicious activities in your organization.

Managing and minimizing risk in an organization starts with understanding the types of risks found in the modern workplace. Some risks are driven by external events and factors, and are outside an organization’s direct control. Other risks are driven by internal events and employee activities that can be eliminated and avoided. Some examples include:

  • Leaks of sensitive data and data spillage
  • Confidentiality violations
  • Intellectual property (IP) theft
  • Fraud
  • Insider trading
  • Regulatory compliance violations

Insider risk management is centered around the following principles:

  • Transparency: Balance user privacy versus organization risk with privacy-by-design architecture.
  • Configurable: Configurable policies based on industry, geographical, and business groups.
  • Integrated: Integrated workflow across Microsoft Purview solutions.
  • Actionable: Provides insights to enable reviewer notifications, data investigations, and user investigations.

Identifying potential risks with analytics

Before configuring any insider risk policies, you can use insider risk analytics to evaluate potential insider risks in your organization. This evaluation can help identify potential areas of higher user risk and determine the type and scope of policies you might consider configuring—without requiring any prior policy setup.

Insider risk management workflow

Insider risk management uses focused policy templates and comprehensive activity signaling across Microsoft 365 to help you identify and resolve risky behavior quickly. The workflow has five stages:

A diagram of the insider risk management workflow.

  • Policies - Insider risk management policies are created using predefined templates and policy conditions that define what risk indicators are examined in Microsoft 365 feature areas. These conditions include how indicators are used for alerts, what users are included in the policy, which services are prioritized, and the monitoring time period.

  • Alerts - Alerts are automatically generated by risk indicators that match policy conditions and are displayed in the alerts dashboard, which provides a quick view of all alerts needing review, open alerts over time, and alert statistics for the organization. DLP alerts can also be viewed in the Microsoft Defender portal, where they're automatically combined into incidents that provide a comprehensive view into potential policy violations.

  • Triage - Alerts with a Needs review status are evaluated by reviewers who can open a new case, assign the alert to an existing case, or dismiss it. Reviewers can examine alert details, associated user activity, severity, and user profile information.

  • Investigate - Cases created from alerts bring together risk activities, policy conditions, alert details, and user details into an integrated view for reviewers. The primary investigation tools are:

    • User activity: An interactive chart shows risk activities over time, letting investigators filter and drill into specific events.
    • Content explorer: Files and email messages linked to an alert are automatically captured and can be filtered by data source, file type, and other attributes.
    • Case notes: Reviewers document findings directly in the case, creating a consolidated audit trail.
    • Data risk graph: Powered by Microsoft Sentinel integration, the data risk graph is an interactive visualization that maps connections between users, devices, cloud resources, and data flows associated with a case. It helps investigators quickly understand the scope and impact of risky activities.

  • Action - Reviewers resolve cases by sending policy reminder notifications to users, or escalating serious cases to Microsoft Purview eDiscovery (Premium) for legal investigation. Alert data can also be exported to external security tools for broader analysis.

Insider risk management addresses these common scenarios:

  • Data theft by departing users: When employees leave an organization—voluntarily or involuntarily—policy templates automatically detect associated theft activities, such as downloading large volumes of files or emailing data to personal accounts.
  • Intentional or unintentional data leaks: Whether accidental or deliberate, policies detect and alert on inappropriate sharing of sensitive or confidential information.
  • Security policy violations: Policies detect risky security activities—such as disabling security features or installing unauthorized applications—using signals from Microsoft Defender for Endpoint.
  • Risky AI usage: As AI tools become part of everyday work, new risks emerge from inappropriate or unauthorized AI use. Insider risk management policies can detect activities such as sending sensitive data to AI services outside of organizational controls, helping organizations govern AI use while protecting sensitive information.
  • Risky agents (preview): As organizations deploy AI agents through platforms like Microsoft Copilot Studio and Microsoft Foundry, those agents interact with users, other agents, and tools. Misconfigured or compromised agents could inadvertently send sensitive data to unauthorized recipients or access restricted resources. The Risky Agents policy template helps detect and surface these agent-related risks.
  • Priority users: Users in high-risk positions—such as executives or IT administrators—can be placed in priority user groups for closer monitoring and more aggressive risk scoring.
  • Healthcare: Organizations in the healthcare industry can use the patient data misuse policy template to detect misuse of patient records and health information. This template helps organizations safeguard patient privacy and comply with regulations such as the Health Insurance Portability and Accountability Act (HIPAA).
  • Risky user behavior: Employment stressor events—such as poor performance reviews or demotions—can trigger risky behavior. Policies use HR data connectors to bring affected users into scope and score related risk indicators.
  • Forensic evidence: Insider risk management supports visual evidence capturing for online and offline devices, giving investigators screen captures to better assess and respond to potentially risky activities.

Insider risk management and AI interactions

As AI tools become part of everyday work, new risks emerge from inappropriate or unauthorized AI usage. Insider Risk Management includes a Risky AI usage policy template that detects activities such as prompt injection attacks, accessing protected materials, and sending sensitive data to AI services outside organizational controls. Insights from these signals are integrated into Microsoft Defender XDR, providing a comprehensive view of AI-related risks alongside other insider threats.

Integration with Microsoft Security Copilot

Microsoft Purview Insider Risk Management supports integration with Microsoft Security Copilot, through the standalone and embedded experiences.

To experience Copilot integration, organizations must be onboarded to Copilot, have enabled Copilot to access data from Microsoft 365 services, and users must have the appropriate role permissions.

In the standalone experience, Microsoft Security Copilot includes built-in prompts for insider risk management scenarios, and you can also enter your own prompts based on the supported capabilities.

Screen capture of the Microsoft Purview capabilities available Microsoft Security Copilot.

In the embedded experience, Microsoft Purview Insider Risk Management supports both alert summarization and the Triage Agent. The Triage Agent is an AI-powered agent that autonomously evaluates alerts based on user risk, file risk, and activity risk, then categorizes and prioritizes them in a managed alert queue — helping analysts focus on the highest-risk activities and reducing time spent on lower-risk alerts. The Triage Agent requires Microsoft Security Copilot onboarding and is available in the alerts queue in the Insider Risk Management solution.

Alert summarization is available directly from the alerts queue. Select any alert and choose Summarize to have Copilot generate a concise summary of that alert's key details and context.