Insider Risk Management in Purview
Microsoft Purview Insider Risk Management (IRM) correlates activity signals from Microsoft 365 to find potentially malicious or inadvertent risky behavior by users, such as data leaks, IP theft and security violations, and lets analysts triage alerts, open cases and act. The decision rule: DLP blocks or warns on a single action against sensitive content, while IRM looks at patterns of behavior over time and asks whether a person is becoming a risk. Microsoft builds it privacy-first: users are pseudonymized by default, with role-based access and audit logs on the analysts.
One alert, followed end to end
The clearest way to learn IRM is to follow a single alert through the pipeline Microsoft Learn describes: policies, alerts, triage, investigate, action.
Scenario. A sales engineer hands in notice on Friday. Contoso has a policy from the Data theft by departing users template.
- Policy. An admin creates the policy from a template. Templates bundle triggering events and risk indicators. Its triggering event is a resignation or termination date, which comes from a Microsoft 365 HR connector, or, if no HR connector is used, from the option that detects the user account being deleted in Microsoft Entra ID.
- Trigger and indicators. The HR record for the engineer is a triggering event. From then on, the policy scores indicators such as downloading many files from SharePoint, printing files or copying data to personal cloud messaging and storage services, within the detection period set in the policy.
- Alert. When scored activity matches the policy conditions, an alert appears in the Alerts dashboard with status Needs review and a severity.
- Triage. A reviewer reads the alert, sees the activity and user profile, and chooses one of three outcomes: open a new case, add the alert to an existing case, or dismiss it.
- Investigate. In the case, the user activity chart plots risk over time, Content explorer lists the files and messages involved, and case notes capture the analyst’s reasoning.
- Action. If it looks like a mistake, the reviewer sends a notice from a notice template (a reminder or a pointer to training). If it is serious, the case is escalated to Microsoft Purview eDiscovery (Premium), where legal teams can preserve and collect content.
At no point does a policy block the file copy itself. That separation is the main idea: IRM detects and routes, other controls such as DLP prevent. See DLP explained for the preventive side.
Templates exam questions refer to
Learn lists these templates: data theft by departing users, data leaks, data leaks by priority users, data leaks by risky users, security policy violations (also by departing, risky and priority users), risky AI usage, and, marked preview on the policy templates page, patient data misuse, risky agents and risky browser usage. Template availability and preview status change, so check the current page before the exam.
| Need | Template family |
|---|---|
| A user is leaving and might take data | Data theft by departing users (trigger from the HR connector or Microsoft Entra account deletion) |
| Accidental or deliberate sharing of sensitive content | Data leaks, plus priority-user and risky-user variants |
| Executives or admins with high access need stricter scoring | Priority user variants, using priority user groups |
| Users under employment stress or with prior risky behavior | Risky-user variants, using the HR connector or a Communication Compliance policy |
| Disabling security tools or installing unapproved apps | Security policy violations (uses Microsoft Defender for Endpoint alerts) |
| Healthcare record misuse | Patient data misuse (preview), HR connector plus a healthcare data connector |
Insider risk versus its neighbors
- Communication Compliance inspects message content (for example harassment). It can feed IRM as a signal, but it does not score data movement.
- DLP acts in the moment on content that matches a rule. See data classification for what feeds those rules.
- Insider risk analytics lets you evaluate risk across the tenant without configuring any policy, to decide which policies to create and whether more licensing is needed.
- Adaptive Protection links IRM risk levels to other Purview controls so protections tighten for riskier users. SC-401 covers it; see the SC-401 Insider Risk Management guide.
Which exams test this
| Exam | How it appears | Where it is covered here |
|---|---|---|
| SC-401 | Manage risks, alerts, and activities (30 to 35 percent): roles, connectors, Defender for Endpoint integration, settings, indicators, choosing a template, policies, forensic evidence, risk levels for Adaptive Protection, alerts, cases and notice templates, plus investigating insider risk activities in the Purview portal | Insider Risk Management explained |
| SC-900 | Describe the capabilities of Microsoft compliance solutions (20 to 25 percent): describing insider risk management alongside eDiscovery and audit | Compliance solutions explained |
| AB-900 | Understand data protection and governance tasks for Microsoft 365 and Copilot (35 to 40 percent): the features of Insider Risk Management next to Communication Compliance and the other Purview solutions, and identifying risks with it | Data protection and governance explained |
How the questions are built
- “A departing employee” means the departing-users template, usually with an HR connector. If the scenario says resignation dates sit in an HR system and never reach Purview, the missing HR connector is the answer; the alternative trigger, account deletion in Microsoft Entra ID, normally fires only once the user has left.
- “Without configuring policies, assess the risk first” means insider risk analytics.
- “Analysts must not see who the user is” means pseudonymization, on by default.
- “Hand the case to legal for preservation and review” means escalating to eDiscovery (Premium).
- “Block the upload” is not an IRM capability; it points to DLP.
- “Send the user a reminder about policy” means a notice template.
The usual trap is choosing IRM when the question is about stopping a single action, or choosing DLP when the stem says “over time”, “patterns” or “risky users”.
Question 1. An organization wants to be alerted when employees who have resigned download unusual amounts of SharePoint data before their last day. Resignation dates are held in the HR system. What should the administrator set up?
- A. A DLP policy that blocks downloads
- B. A retention policy on SharePoint
- C. A sensitivity label with encryption
- D. An Insider Risk Management policy from the departing users template with the HR connector
Show answer
Answer: D
The data theft by departing users template starts scoring from a resignation or termination date. Because the dates are held in the HR system, the Microsoft 365 HR connector is what brings them into Purview; the alternative trigger, account deletion in Microsoft Entra ID, normally fires only once the user has left. A DLP policy reacts to sensitive content in a single action and knows nothing about employment status. A retention policy keeps or deletes content. A sensitivity label protects an item but does not detect behavior.
Question 2. A risk analyst reviews an Insider Risk Management alert and decides the activity needs deeper review and, if confirmed, legal preservation of the user's content. What are the correct next steps?
- A. Open a case, investigate, and escalate it to eDiscovery (Premium) if warranted
- B. Delete the user’s mailbox to stop the risk
- C. Dismiss the alert and create a DLP rule
- D. Wait for the alert to expire
Show answer
Answer: A
Triage resolves an alert by opening a case, adding it to an existing case or dismissing it. A case is where the investigation happens, and a serious case can be escalated to eDiscovery (Premium) for preservation and review. Deleting the user’s mailbox destroys evidence. Dismissing the alert ends the review. A DLP rule does not manage cases.
Go deeper
- Learn about Insider Risk Management (Microsoft Learn)
- Insider Risk Management policy templates (Microsoft Learn)
- Related topics: DLP explained, sensitivity labels explained, zero trust explained
- Alerts and activities explained for SC-401