Microsoft Purview | Insider Risk Management: Policy tuning analysis for priority content only policies

Microsoft Purview’s Insider Risk Management will support policy tuning analysis for priority content policies starting mid-June 2025, completing by mid-July 2025. Admins can use real-time analytics to predict user matches to policy conditions, adjust indicators, and thresholds, and efficiently manage insider risk strategies. No action is required before rollout. In Microsoft Purview | Insider Risk Management (IRM), policy tuning analysis provides admins with a real-time prediction of the number of users in a tenant that could potentially match a given set of policy conditions. After this rollout, policy tuning analysis will support insider risk policies that are scoped for priority content. This message is associated with Microsoft 365 Roadmap ID 378409. This message is associated with MC786326 (about the preview for this feature that started in May 2024). When this will happen: General Availability (WW, GCC, GCC High, DoD): We will begin rolling out mid-June 2025 and expect to complete by mid-July 2025. How this will affect your organization: After this rollout, admins can use real-time analytics for policies scoped for priority content to help predict the number of users that could potentially match a given set of policy conditions. This feature enables admins to quickly adjust the selection of indicators and thresholds of activity occurrence so they can efficiently translate their insider risk strategies into pragmatic controls and keep from having too few or too many alerts. 1. In IRM, Navigate to Settings > Insider Risk Management > Analytics, turn on Analytics, and then select Save. View image in new tab 2. Create/edit a policy scoped to all users in the organization. 3. When you get to Content to prioritize in the policy wizard, select the priority content types you want to prioritize: View image in new tab 4. Select the items for each priority content type as applicable. 5. On the scoring page, select Get alerts only for activity that includes priority content: View image in new tab 6. Configure the rest of the policy as applicable and save it. 7. 1-2 days after the policy is saved, edit the policy again and navigate to the indicator thresholds […]

The post Microsoft Purview | Insider Risk Management: Policy tuning analysis for priority content only policies appeared first on M365 Admin.