Create insider risk management notice templates

  • 4 minutes

Insider risk management notice templates automatically email users when their risky actions match a policy, confirm an alert, and trigger a case creation. These alerts often result from mistakes or unintentional actions. The notices serve as simple reminders for users to exercise caution and provide links to training resources or corporate policies. They also help create a documented audit trail for users who repeatedly engage in risky activities. By creating notice templates, you can incorporate email reminders into the case resolution process. Keep in mind that notices can only be sent to the email address associated with the specific case. When applying a notice template, you can use the predefined field values or customize them as needed.

Notice templates dashboard

The Notices templates dashboard displays a list of configured notice templates and allows you to create new notice templates. The notice templates are listed in reverse date order with the most recent notice template listed first.

Screenshot of the insider risk management notice template dashboard.

HTML for notices

If you'd like to create more than a simple text-based email message for notifications, you can create a more detailed message by using HTML in the message body field of a notice template. The following example provides the message body format for a basic HTML-based email notification template:

<!DOCTYPE html>
<html>
<body>
<h2>Action Required: Contoso User Code of Conduct Policy Training</h2>
<p>A recent activity you've performed has generated a risk alert prohibited by the Contoso User <a href='https://www.contoso.com'>Code of Conduct Policy</a>.</p>
<p>You are required to attend the Contoso User Code of Conduct <a href='https://www.contoso.com'>training</a> within the next 14 days. Please contact <a href='mailto:hr@contoso.com'>Human Resources</a> with any questions about this training request.</p>
<p>Thank you,</p>
<p><em>Human Resources</em></p>
</body>
</html>

Note

HTML href attribute implementation in the insider risk management notice templates currently support only single quotation marks instead of double quotation marks for URL references.

Create a new notice template

To create a new insider risk management notice template, you use the notice creation tool in Insider risk management solution in the Microsoft Purview compliance portal.

Complete the following steps to create a new insider risk management notice template:

  1. In the Microsoft Purview compliance portal navigate to Insider risk management and select the Notice templates tab.
  2. Select Create notice template to open the notice creation tool.
  3. On the Create a new notice template page, fill in the necessary information:
    • Template name: Give the notice a friendly name.
    • Send from: Provide the sender's email address. This address appears in the From: field.
    • Cc and Bcc: Add optional users or groups to be notified.
    • Subject: Information to be used as the message's subject line, consisting of text characters.
    • Message body: Information to be used as the message's body, supports text or HTML values.
  4. Select Create to save your new notice template, or select Cancel to close without saving the notice template.

Update a notice template

To update an existing insider risk management notice template, complete the following steps:

  1. In the Microsoft Purview compliance portal, go to Insider risk management and select the Notice templates tab.
  2. On the notice dashboard, select the notice template you want to manage.
  3. On the notice details page, select Edit.
  4. On the Edit page, you can edit the following fields:
    • Template name: Give the notice a new friendly name.
    • Send from: Update the sender's email address. This address appears in the From: field.
    • Cc and Bcc: Update optional users or groups to be notified of the policy match, selected from the Active Directory for your subscription.
    • Subject: Update information to be used as the message's subject line, consisting of text characters.
    • Message body: Update information that appears in the message body, supports text or HTML values.
  5. Select Save to update and save the notice or select Cancel to close without saving the notice template.

Delete a notice template

To delete an existing insider risk management notice template, complete these steps:

  1. In the Microsoft Purview compliance portal navigate to Insider risk management.
  2. Select the Notice templates tab.
  3. Choose the notice template you want to remove.
  4. Select the Delete icon on the toolbar.
  5. Confirm the deletion by selecting Yes or cancel the action by selecting Cancel.