Microsoft Purview | Insider Risk Management: Enhancements to global exclusions in IRM settings

Enhancements to Microsoft Purview’s Insider Risk Management (IRM) exclusions will reduce alert noise, including updates to keyword logic, file path exclusions, and domain exclusions. Public Preview starts mid-April 2025, with General Availability by early May 2025. Admins should update exclusion settings in IRM. Coming soon for Microsoft Purview | Insider Risk Management (IRM): Enhancements to IRM exclusions to reduce alert noise. This message is associated with Microsoft 365 Roadmap ID 486826 and Roadmap ID 483485. When this will happen: Public Preview: We began rolling out mid-April 2025 and expect to complete by late April 2025. General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out late April 2025 and expect to complete by early May 2025. How this will affect your organization: Customer can use this feature to tune down the noise Keyword logic update for email: An email will be excluded from scoring only when all the attachments match the keyword exclusions or email subject matches the keyword exclusions. This will be helpful to reduce the email signature noise that commonly contains keyword “image.” Keyword exclusions on both target and source file paths: For signals like File copied to removable media, keyword exclusions apply on both target and source file paths. File path exclusions for removable media: We will start supporting file path exclusions for removable media. Exclusion support for browser: Domain exclusions will be supported for browsing indicators. These enhancements will be available by default for admins to configure. What you need to do to prepare: Settings > Global exclusions. Microsoft Purview | Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies based on their own internal policies, governance, and organizational requirements. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy. Message ID: MC1058262

The post Microsoft Purview | Insider Risk Management: Enhancements to global exclusions in IRM settings appeared first on M365 Admin.