Insider Risk Management
Microsoft Purview Insider Risk Management helps you detect, investigate, and act on risky and malicious activities within your organization. Using behavioral analytics and machine learning, it identifies patterns that may indicate data theft, policy violations, or security threats—before damage occurs.
What is Insider Risk Management?
Insider Risk analyzes user behavior across Microsoft 365:
| Signal Source | Examples |
|---|---|
| Unusual attachment volume, external sends | |
| Files | Mass downloads, USB copies, cloud uploads |
| Identity | Sign-ins from new locations, privilege escalation |
| HR Events | Resignation dates, performance issues |
| Browsing | Access to job sites, sensitive URLs |
How It Works
Signals collected → Risk scoring → Alert generation → Investigation → Action
| Stage | What Happens |
|---|---|
| Signals | Audit logs, DLP events, HR data ingested |
| Scoring | ML models analyze behavior patterns |
| Alerts | High-risk activities surface to reviewers |
| Investigation | Reviewers examine activity timeline |
| Action | Escalate, notify, or take remediation steps |
Policy Templates
| Template | Detects |
|---|---|
| Data theft by departing users | Exfiltration when employees resign |
| Data leaks | Unusual sharing or downloading patterns |
| Security policy violations | Access to blocked sites, banned apps |
| Patient data misuse | Unauthorized access to health records |
| Risky browser usage | Visits to unacceptable websites |
Key Capabilities
Activity Explorer
Detailed timeline of user activities across all Microsoft 365 workloads.
Risk Scoring
Each user receives a dynamic risk score based on their behavior patterns.
Intelligent Alerts
Surface only the highest-risk activities, reducing alert fatigue.
HR Integration
Incorporate resignation dates, performance improvement plans, and other HR events.
Privacy Controls
Pseudonymization options protect user identities until investigation warranted.
Common Scenarios
Departing Employee Monitoring
When HR marks someone as leaving, Insider Risk increases monitoring sensitivity to catch data exfiltration.
Unusual Exfiltration
User suddenly downloads 10x their normal file volume or copies to USB—triggers investigation.
Privilege Misuse
Admin account accesses data outside their normal scope—flagged for review.
Quick Links
| Resource | Description |
|---|---|
| Purview Insider Risk | Case management |
| Insider Risk Overview | Microsoft documentation |
| Implementation Guide | Enterprise deployment guide |
Related Solutions
- Audit — Provides activity data for risk scoring
- Data Loss Prevention — DLP alerts feed risk signals
- Communication Compliance — Monitor message content