Investigate insider risk alerts and related activity

  • Module
  • 11 Units
Intermediate
Administrator
Risk Practitioner
Microsoft Purview
Microsoft 365

Investigate insider risk alerts and manage related cases in Microsoft Purview to assess user behavior, take appropriate action, and coordinate deeper reviews across teams.

Learning objectives

After completing this module, you'll be able to:

  • Understand how alerts are generated and prioritized in Insider Risk Management.
  • Tune policies and thresholds to manage alert volume effectively.
  • Use the Alerts dashboard and alert details to triage and respond to risky activity.
  • Investigate behavior using tabs like All risk factors, Activity explorer, and User activity.
  • Integrate with Microsoft Defender XDR for broader threat investigation.
  • Create, manage, and resolve Insider Risk Management cases.

Prerequisites

  • Familiarity with Microsoft Purview Insider Risk Management policies and indicators
  • Basic understanding of Microsoft 365 compliance and security tools
Start