Microsoft Purview · Insider Risk Management

Spot the risky pattern before the data walks out the door.

Insider Risk Management (IRM) watches for sequences of user activity that together look risky: a resignation followed by mass downloads, a renamed file copied to USB, customer data pasted into an AI chatbot. It scores that risk, raises an alert, and gives a small, authorized team the evidence to act. Names are hidden by default, so it protects the company without turning into surveillance.

Departing employeesData leaksRisky AI useAI agentsSecurity violationsPrivacy by design
01
Insiders already have access

Firewalls and MFA stop outsiders. An employee leaving for a competitor has a valid login and legitimate access to the files.

02
One action is rarely the problem

Downloading a file is normal. Downloading 400 files the week after resigning, zipping them and copying them to USB is not. IRM looks at the pattern.

03
Most leaks are accidents

IRM also catches careless behavior, such as oversharing or pasting sensitive data into AI tools, so you can coach people instead of punishing them.

Think of IRM as a smoke detector, not a camera. It doesn't record everything people do; it sounds when the combination of signals looks like fire.

How it works

From signal to action, in six stages

Every IRM policy follows the same pipeline. Keep this picture in mind; every menu item and every policy setting fits into one of these boxes.

1 · SIGNALS

Collect

Activity from Microsoft 365, devices, browsers, HR systems and other clouds.

2 · TRIGGER

Bring into scope

An event that starts scoring a user: resignation date, DLP alert, risky AI prompt.

3 · INDICATORS

Score

Each risky activity adds points. Sequences, unusual volume and sensitive content boost the score.

4 · ALERT

Flag

When the score crosses a threshold, an alert with low, medium or high severity is created.

5 · TRIAGE

Investigate

An analyst (with help from the Triage Agent) reviews the timeline and opens a case.

6 · ACT

Respond

Send a notice, escalate to HR or legal, preserve evidence, or tighten controls automatically.

Watch it happen: one departing employee

Click each event to see how the user's risk score builds. "Alex" is fictional, and analysts see a pseudonym like AnonIS8-988 until they are allowed to reveal the name.

Signals from outside Microsoft

Top 10 non-Microsoft signals IRM can use

IRM is strongest when it sees beyond Microsoft 365. These ten sources come from systems your customer already runs. Each card shows how the signal gets into Purview.

1

HR system

Resignation and termination dates, performance plans, poor reviews, job-level changes. Workday, SAP SuccessFactors, Oracle HCM and others.

HR data connector
2

Physical badging

Building and room access, for example entering a lab after hours or after resigning.

Physical badging connector
3

Epic EMR

Who opened, changed or exported patient records, including relatives' or neighbors' records.

Epic connector
4

Other health record systems

Same idea for non-Epic electronic medical record platforms.

Healthcare connector
5

Google Drive, Box, Dropbox

Downloads, uploads and sharing in third-party cloud storage.

Defender for Cloud Apps · PAYG
6

Amazon S3 / AWS

Unusual reads, deletions or exports from cloud storage buckets.

Defender for Cloud Apps · PAYG
7

Google Chrome

Uploads and copy-paste to websites, visits to risky or generative AI sites.

Purview extension for Chrome
8

Third-party AI apps

ChatGPT, Gemini and other AI tools: sensitive data in prompts, risky usage.

Browser · Entra / Data Map connectors
9

Network security partners

HTTP/HTTPS traffic seen by third-party SASE/SSE and proxy tools.

Collection policy · PAYG
10

SIEM & business apps

Pre-aggregated detections from Splunk or other tools, and apps like Salesforce, as custom indicators.

Insider Risk Indicators connector
Microsoft signals it uses out of the box:SharePoint & OneDriveExchange emailTeamsWindows & Mac devicesEdge browserDLP alertsDefender for EndpointEntra ID ProtectionCommunication ComplianceFabric & Power BICopilot & agents

Step zero

Before you click anything: prerequisites and dependencies

IRM has a few hard requirements and several "unlocks". You can create a basic policy on day one, but most templates need at least one extra signal source. The biggest prerequisite is not technical: get HR, legal and privacy on board first.

Tenant checklist

  • Required · LicensesMicrosoft 365 E5, E5 Compliance, or the E5 Insider Risk Management add-on. Some indicators are pay-as-you-go. See Licensing.
  • Required · Role groupsInsider Risk Management Admins, Analysts, Investigators, Auditors and Approvers. Split duties so no single person sees everything. Settings › Roles & scopes
  • Required · Audit log onIRM reads activity from the Microsoft 365 unified audit log.
  • Required · IRM settingsPolicy indicators are off by default. Turn on the ones you need, plus privacy and timeframes. Settings › Insider Risk Management
  • Recommended · AnalyticsA no-policy scan of your tenant that shows where risk exists. Results within about 48 hours.
  • Recommended · HR connectorNeeded for departing-user and risky-user templates. Without it, "account deleted in Entra" is the only departure trigger.
  • Recommended · Devices onboardedWindows 10 1809+ or the three latest macOS versions. Unlocks USB, print and browser-upload indicators.
  • Per template · Other unlocksA high-severity DLP policy (Data leaks), Defender for Endpoint (Security violations), priority user groups, browser extensions (Risky AI usage, Risky browsing), healthcare and badging connectors.

Privacy by design

ID
Pseudonymized by default
Analysts see an alias, not a name, until someone with the right role reveals it.
alex.morgan@contoso.com→AnonIS8-988
RB
Role-based access
Analysts triage, investigators see content, auditors review what the team did.
AU
Every action is audited
Who opened which alert, who revealed a name, who exported evidence.
0
Users are not notified automatically
Notices are sent only when an investigator decides to, using notice templates.

Customer tip: In many regions (EU works councils, for example) employee monitoring needs a formal review. Start this conversation in week one, not after the pilot.

Bottom line for a customer: With E5, Entra ID and the audit log you can start on day one. To make IRM work well, it borrows from other products: device sensors from Defender for Endpoint, cloud app connections from Defender for Cloud Apps, labels and classifiers from Information Protection, alerts from DLP, and HR data through connectors. The next section maps every one of them.

Dependency map

What IRM needs to operate

IRM is an analytics engine. It owns very little data itself: it reads signals that other Microsoft products and connectors collect, and it uses content definitions from Information Protection. Pick a policy below to light up exactly what it needs, or click any box for details.

RequiredOne of these options is requiredOptional, adds signalNot used by this selection

Readiness in three tiers

A simple way to explain the rollout to a customer: what you need, and what each tier unlocks.

Tier 1 · Day one

Minimum to run IRM

Unlocks: Analytics, Office indicators from Microsoft 365, Data leaks with custom thresholds, Data theft using the Entra account-deletion trigger, Risky Agents (on by default).

Tier 2 · Top 3 policies

Make the main policies useful

Unlocks: Data theft by departing users with real resignation dates, Data leaks triggered by DLP, Risky AI usage, Risky browser usage, device exfiltration (USB, print, uploads), priority content scoring, Adaptive Protection.

Tier 3 · Full coverage

Every template and feature

Unlocks: Security policy violations, risky-user and priority-user variants, Health record misuse, third-party cloud and network indicators, compromised-identity context, Triage Agent, forensic evidence.

Full dependency matrix

Every input against every template and feature. Click a column header to highlight it in the diagram above, or a row to open its details.

"Security policy violations" covers all four variants: the base template needs only Defender for Endpoint; the departing and risky variants add the HR connector or Communication Compliance; the priority variant adds priority user groups.

The click path

Where do I click first? Then what?

The menu is short, but the order matters. This is the sequence that works in real deployments. Chips open each menu item's explanation.

The core of IRM

Build a policy, step by step

This replays the real "New insider risk policy" wizard. Pick one of the three most common policies, then walk through the eight steps exactly as they appear in the portal. Each step shows what to choose and why.

Insider risk management › New insider risk policy

    All templates in the wizard

    Highlighted cards are the three walked through above. Each card shows what starts the policy and what you need before you can pick it.

    Portal map

    Every item in the left menu, explained

    The top block mirrors your portal menu. Alerts and Cases are where the daily work happens; depending on the portal version they sit in the menu or open from Overview. Settings lives in the left rail.

    One picture

    IRM as a mind map

    Menu items grouped by the job they do. Click any leaf to jump to its explanation.

    AI, Copilot and agents

    Three ways IRM meets AI

    IRM watches people using AI, watches AI agents themselves, and uses AI to help analysts work faster.

    1 · People using AI

    Risky AI usage policy

    Detects risky or sensitive prompts and responses in Microsoft 365 Copilot, Microsoft Copilot and agents, and visits to generative AI websites.

    User prompt→sensitive data?→risk score→alert
    • Copilot experiences: Microsoft 365 Copilot at no extra charge; Fabric, Security Copilot and Copilot Studio data is pay-as-you-go.
    • Other AI apps (ChatGPT, Gemini) are seen through Edge and Chrome extensions.
    • Azure AI Content Safety: flags prompt-injection attempts and protected material.
    • Create it in one click from DSPM for AI.
    2 · AI agents as insiders

    Risky Agents policy preview

    Agents act with real permissions, so IRM treats them like users. The policy is on by default for licensed tenants.

    Copilot StudioMicrosoft FoundryPurview SDK apps
    • Risky prompts sent to the agent
    • Sensitive data in agent responses
    • Agent reading sensitive or priority SharePoint files
    • Agent sharing files externally or visiting risky sites
    • Activity above the agent's usual daily level

    Agent risk is also shown in DSPM for AI and the Microsoft 365 admin center. Admin units don't apply to agent alerts yet.

    3 · AI helping the analyst

    Triage Agent

    A Security Copilot agent inside Purview that reviews IRM alerts on a schedule and sorts them, with an explanation for each.

    Needs attention
    Less urgent
    Not categorized
    • You choose policies and look-back window, and can add instructions in plain language.
    • Needs Security Copilot with provisioned capacity (SCUs, pay-as-you-go).
    • One instance per tenant; it runs as the admin who last saved its settings, re-saved every 90 days.

    Adaptive Protection closes the loop: an elevated AI-risk user can be blocked from AI apps by Conditional Access or DLP automatically.

    Real-world scenarios

    Three problems IRM solves

    Each scenario matches one of the three policies in the wizard above.

    Brief note

    Licensing at a glance

    Licensing changes often; confirm in Microsoft's service description before quoting a customer.

    Per-user licenses

    Microsoft 365 E5, E5 Compliance, or the E5 Insider Risk Management add-on (also available with E3 as a base).

    Pay-as-you-go

    Billed through an Azure subscription: cloud storage and cloud service indicators, network indicators, Fabric, non-Microsoft-365 AI apps.

    Add-ons

    Forensic evidence capacity is purchased separately. The Triage Agent consumes Security Copilot compute units.

    Microsoft Purview service description (licensing)

    Words you will hear

    Glossary

    Policy template
    A predefined scenario (departing users, data leaks, risky AI) that sets the trigger and suggested indicators.
    Triggering event
    The event that brings a user into a policy's scope and starts risk scoring, such as a resignation date.
    Indicator
    A risky activity that adds to the score: downloading, printing, copying to USB, sharing externally.
    Sequence
    A chain of related activities, such as download → rename → exfiltrate, scored higher than each step alone.
    Cumulative exfiltration
    A user moving far more data out than their peers or their own normal.
    Priority content
    Sites, labels, info types or file types you care most about. Activity on them scores higher.
    Priority user group
    People with extra access or exposure, such as executives or engineers on a secret project.
    Pseudonymization
    Showing an alias instead of a user's real name to analysts. On by default.
    Adaptive Protection
    Assigns each user an insider risk level (minor, moderate, elevated) that DLP and Conditional Access react to.
    Forensic evidence
    Approved, short screen captures of specific high-risk activity on Windows devices, for investigations.
    Admin units
    Scope a policy or analyst to part of the organization, for example one country.
    Past activity detection
    How far back IRM scores activity once a user is triggered, up to 180 days.