Microsoft Purview compliance portal: Insider Risk Management – IRM alerts in XDR

This post discusses the inclusion of Insider Risk Management (IRM) alerts in Microsoft Defender XDR. With this feature, IRM alerts and associated data will be available in various Microsoft Defender XDR experiences, including the unified alert and incident queue, advanced hunting, and the Graph API. Through the use of KQL queries, analysts can identify hidden risky patterns in data security-related user activities. The "Share data with Microsoft Defender XDR" feature must be enabled in Microsoft Insider Risk Management settings to use this feature, and it is only accessible by users with Insider risk analyst or Insider risk investigator permissions in Purview to ensure data privacy. Although IRM data in Microsoft Defender XDR does not honor anonymization, it allows for effective correlation of IRM alerts with alerts from other solutions in the Microsoft Defender XDR platform. The Microsoft Purview Insider Risk Management is constructed to identify potential insider risks, including IP theft, data leakage, and security violations, and has privacy features such as default pseudonymization, role-based access controls, and audit logs. This post is from M365 Admin and provides a roadmap ID (422730) and link to the Microsoft roadmap.