SC-401 insider risk management explained
Insider Risk Management (IRM) in Microsoft Purview detects risky activity by people inside the organisation, such as data theft before resignation or leaks to personal accounts, and routes the findings to investigators. It is one of the biggest topics in the 30–35% domain Manage risks, alerts, and activities. The exam asks you to pick the right template, set up the signals it needs, and work an alert through to a case.
How IRM works
IRM does not block anything. It reads signals, scores activity against indicators, raises alerts for risky patterns and lets investigators decide. Four ideas hold it together:
- Policies built from templates define who is in scope and which activity matters.
- Indicators are the activity types counted, for example file downloads, copies to USB or sharing outside the organisation.
- Alerts are generated when scored activity passes thresholds.
- Cases are created from alerts that need investigation.
Roles and permissions
IRM uses its own role groups to separate duties: administrators who configure it, analysts who triage alerts, investigators who work cases with more access, and auditors who review audit logs. Usernames can be pseudonymised so that analysts judge behaviour before identity is revealed.
Signals and connectors
| Need | Provided by |
|---|---|
| Leaving date of the employee | HR connector |
| Physical access data | Physical badging connector |
| Device activity such as copy to USB or print | Devices onboarded to Purview, with Defender for Endpoint integration for some scenarios |
| Alerts from security tools | Integration with Microsoft Defender for Endpoint |
Choose templates by the signals you have. The Data theft by departing users template needs an HR connector; a policy template for security policy violations draws on Defender for Endpoint alerts. Other templates cover data leaks, leaks by priority users and risky behaviour in other scenarios.
Settings that shape the policy
- Policy indicators: enable or disable activity types and adjust thresholds.
- Priority user groups: give higher scrutiny to selected users.
- Notice templates: reminder messages sent to users as part of a workflow.
- Forensic evidence: captures device activity for a user under investigation, with approval by the right role. Its settings are separate from general IRM settings.
Adaptive Protection
Adaptive Protection assigns insider risk levels (elevated, moderate, minor) to users based on their IRM activity. Those levels can then drive other controls, such as DLP rules and Conditional Access, so that the controls tighten for risky users and relax for others.
Alerts and cases
Alerts appear with severity and activity summaries. Analysts triage them: dismiss, or confirm and create a case. A case collects the user activity timeline, supports notes and, where configured, notice templates and forensic evidence. Investigations of insider risk activities are done in the Purview portal; see the alerts and activities guide.
Three example questions
Question 1. You want IRM to flag data exfiltration by employees who have given notice. Which template and signal source are required?
- A. Data leaks template with a retention policy
- B. Data theft by departing users with an HR connector
- C. Any template with an audit retention policy
- D. Data leaks template with a physical badging connector only
Show answer
Answer: B
The Data theft by departing users template uses resignation and termination dates, which come from an HR connector. The Data leaks template does not use departure dates. A retention policy and an audit retention policy supply no HR signal.
Want more questions like this? Full SC-401 practice tests →
Question 2. Analysts should triage alerts without immediately seeing real usernames. Which IRM capability helps?
- A. Notice templates
- B. Forensic evidence
- C. Priority user groups
- D. Pseudonymisation of usernames
Show answer
Answer: D
Pseudonymisation hides usernames in the IRM interface so that analysts judge behaviour first. Notice templates message users, forensic evidence captures device activity, and priority user groups raise scrutiny; none of them hides identities.
Want more questions like this? Full SC-401 practice tests →
Question 3. A security team wants users who show risky IRM behaviour to be automatically blocked by DLP from sharing files externally. What should they enable?
- A. Adaptive Protection, then use the risk level in a DLP policy
- B. A notice template
- C. A physical badging connector
- D. An eDiscovery hold
Show answer
Answer: A
Adaptive Protection turns IRM activity into insider risk levels that DLP policies can use as conditions. Notice templates only send messages. Connectors bring in data but do not enforce blocks. An eDiscovery hold preserves content and does not stop sharing.
Want more questions like this? Full SC-401 practice tests →
What to practise
Walk the whole chain once: enable a policy from a template, set indicators, generate or review a test alert, convert it to a case, and look at the Adaptive Protection settings. Then see how risk levels feed the DLP guide.