Microsoft Purview compliance portal: Insider Risk Management- Enhancements to the unusual activity booster detection

Microsoft Purview Insider Risk Management has rolled out an enhancement to its unusual activity booster detection feature, which will now be able to better detect unusual user activity by using historical data to set activity as unusual. Organisations that have opted in to the "Activity is above user’s usual activity for that day" risk score booster can expect to see fewer activities with the feature. The solution uses various signals to detect potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations, enabling the creation of policies that help manage security and compliance.

Built with privacy in mind, the tool pseudonymises users by default and implements both role-based access controls and audit logs, which help ensure user-level privacy. The update is currently in the General Availability Release phase, with a release date set for January CY2024, and is available on the web and cloud instances of GCC, GCC High, and DoD.

For more information, refer to the Microsoft Purview compliance portal article on Insider Risk Management's unusual activity booster detection enhancement.

The post originally appeared on M365 Admin.