Microsoft Purview Insider Risk Management (IRM) detects, investigates, and acts on risky behaviors by users within the organization. Unlike DLP — which acts on content policy — IRM acts on behavioral signals: who is doing what, when, at what volume, and in what context.
IRM is privacy-aware by design: users are anonymized in the analyst dashboard by default. Investigations require role-based permissions (Insider Risk Investigators) and a formal case workflow before accessing identified user details.
Data theft by departing users · Security policy violations · Data leaks · Patient data misuse · Priority user protection · Risky browser usage. Each template uses a distinct indicator set and scoring model.
Signals that contribute to risk scoring: download volume, USB transfer, print activity, email to personal domain, SharePoint access from unusual location, cloud app upload, label downgrade, and more. Indicators are tunable per policy.
DLP policy violations can be used as IRM indicators. Label downgrade events (e.g., Restricted → Internal) are high-signal IRM triggers. Sequence detector can correlate label + download + external share in a single risky pattern.
Alerts → Triage → Cases → Investigation → Action. Investigators can review content, activity timeline, and communication patterns (with proper permissions). Actions include HR notification, policy review, or account restriction.
Default anonymization of user display names. Opt-in deanonymization requires dual-role confirmation. Audit log captures every analyst action. GDPR and privacy guidance must be reviewed before deployment in regulated jurisdictions.
DSPM behavioral signals (large volume download of sensitive content, repeated access to restricted repositories) feed IRM as contextual amplifiers. Combine DSPM posture data with IRM indicator thresholds for higher-confidence alerting.
Build the Insider Risk Management module for the CNC Data Security Platform. FILE: docs/insiderrisk.html STYLE: use g1-platform.css, g1-platform.js (same as all other topics) THEME: data-theme="sapphire" on html element SECTIONS TO BUILD: 1. What Is IRM — definition, privacy model, role requirements 2. Policy Templates — all 6 standard templates with indicator sets 3. Indicator Configuration — tunable indicators, threshold guidance 4. Sequence Detection — multi-step risky pattern detection 5. DLP + Label + IRM Integration — how signals combine 6. Case Workflow — Alert → Triage → Case → Investigation → Action 7. Privacy and Legal Considerations — anonymization, GDPR, consent 8. DSPM Signal Amplification — how DSPM feeds IRM 9. Best Practices — rollout guidance, indicator tuning, false positive management 10. References PRINT VIEW: Include <section class="g1-print-view"> with A4 infographic summary Use same pv-cover / pv-body / pv-row / pv-block / pv-refs structure TAXONOMY: use 4-label taxonomy (Public, Internal, Confidential, Restricted) as defined in labeling.html NAMING RULES: "Module 06 — Governance & Discovery" in page header label NO calendar dates in rollout guidance — use week-based phases only
| Concept | Definition |
|---|---|
| IRM Policy | A configured ruleset using a template that defines which indicators trigger alerts for which users |
| Indicator | A signal that contributes to a user's risk score (e.g., USB copy of sensitive file) |
| Risk Score | Cumulative score based on indicator activity within the policy window — triggers alerts at defined thresholds |
| Sequence Detector | Detects multi-step patterns: e.g., label downgrade → mass download → external email |
| Anonymization | Default: user names replaced with aliases in analyst view. Deanonymize requires role confirmation. |
| Priority User Group | Designated high-risk users (e.g., executives, contractors, employees on PIP) with elevated scoring weights |
| Alert Triage | Initial review of an alert — confirm, dismiss, or escalate to a case |
| Case | Formal investigation container with content evidence, timeline, and action log |