Microsoft Purview compliance portal: Insider Risk Management – Entra compromised user signals in IRM

Microsoft Purview has rolled out a new feature that allows IRM analysts to identify any compromised user alerts in Microsoft Entra while investigating an incident. This feature can help in formulating an appropriate response, such as escalating the incident to the SOC teams for quick remediation. Microsoft Entra offers two types of compromised user detections: sign-in risk detections and user risk detections. Insider risk management admins can choose to opt into each type from global settings. Risk detections will be available in the indicator timeline within the alert investigation experience, and they will not affect the risk score or severity of Insider risk management alerts. The Insider Risk Management solution from Microsoft Purview is designed to identify potential malicious or inadvertent insider risks, such as data leakage, IP theft, and security breaches. It allows customers to create policies based on their own internal policies, governance, and organizational needs. This feature is built with privacy by design, and ensures user privacy through role-based access controls and audit logs. For more information on the feature and its release phase, visit the link provided.

The post Microsoft Purview compliance portal: Insider Risk Management - Entra compromised user signals in IRM appeared first on M365 Admin.