Microsoft Purview Insider Risk Management: Public preview of insider risk insights in DLP alerts

Microsoft Purview Insider Risk Management is rolling out a public preview of insider risk insights in DLP (Data Loss Prevention) alerts. This update will allow a DLP analyst to access an insider risk summary of user activities that may lead to potential data security incidents. The feature will help analysts gain context in DLP alerts, enabling them to make more informed decisions on responses to potential incidents. This new capability correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. It enables customers to create policies based on their own internal policies, governance, and organizational requirements.

To activate the feature, insider risk management admins have to opt-in by going to insider risk settings and exporting alerts. Once activated, DLP analysts can start seeing insights for a subset of exfiltration indicators. The rollout is expected to begin in late November and be completed by late December. The Microsoft Purview Insider Risk Management solution is available in Microsoft Purview Compliance Portal and has audit logs and role-based access controls in place to ensure user-level privacy.

The post Microsoft Purview Insider Risk Management: Public preview of insider risk insights in DLP alerts originally appeared on M365 Admin.