Microsoft Purview | Insider Risk Management: New compromised user context in Microsoft Entra

Microsoft Purview Insider Risk Management will soon allow analysts to identify compromised user alerts in Microsoft Entra, aiding in appropriate response actions. This feature will roll out globally in March 2025. Admins need to review configurations and notify users, but no immediate action is required. Coming soon to Microsoft Purview | Insider Risk Management: IRM analysts will be able to identify if a user being investigated has any compromised user alerts in Microsoft Entra. The new visibility will help the analyst formulate the right response action, such as escalating the Incident to SOC teams for quick remediation. This message is associated with Microsoft 365 Roadmap ID 420938. When this will happen: General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out mid-March 2025 and expect to complete by late March 2025. How this will affect your organization: Microsoft Entra offers two types of compromised user detections: Sign-in risk detections: Compromise risk associated with a specific sign-in User risk detections: Compromise risk associated with a specific user After this rollout: Risk detections will be available in the indicator timeline in the alert investigation experience. Risk detections will not impact the risk score or severity of Insider Risk Management alerts. To access the new risk detections, go to Microsoft Purview portal > Settings > Insider Risk Management > Policy indicators > Built-in Indicators. Scroll down to Microsoft Entra ID Protection indicators, open the dropdown menu and select the applicable indicators: View image in new tab When you create a policy, you will find Microsoft Entra ID Protection indicators on the Indicators page: This change will be available by default. What you need to do to prepare: Learn more View image in new tab This rollout will happen automatically by the specified date with no admin action required before the rollout. Review your current configuration to determine the impact for your organization. You may want to notify your users about this change and update any relevant documentation. Insider risk management admins can opt into risk detections from Insider Risk Management global settings. Insider risk management admins need to opt into risk […]

The post Microsoft Purview | Insider Risk Management: New compromised user context in Microsoft Entra appeared first on M365 Admin.