SC-401 - Insider Risk Management

Quick Navigation

IRM Overview and Architecture
IRM Roles and Permissions
Connectors and Data Sources
Policy Templates
Risk Indicators
Forensic Evidence
Adaptive Protection Integration
Defender for Endpoint Integration

IRM Overview and Architecture

Microsoft Purview Insider Risk Management (IRM) detects, investigates, and helps remediate internal risks - actions by current or former employees that could expose sensitive data or harm the organization. IRM uses a privacy-by-design approach: users are pseudonymized in alerts until an authorized investigator chooses to de-anonymize.

IRM Signal Sources

IRM correlates signals from multiple Microsoft 365 data sources to build user risk scores:

Microsoft 365 activities (SharePoint, OneDrive, Exchange, Teams)
Azure AD signals (HR connector events like resignation notices)
Microsoft Defender for Endpoint (endpoint activities: USB copy, browser upload, printing)
HR connector (resignation, performance review data from HRIS systems)
Custom connectors (via Logic Apps or Graph API)
Communication Compliance signals (communication policy matches)

IRM requires at minimum: Microsoft 365 E5 or Microsoft 365 E3 + Insider Risk Management add-on. The service processes activity data in the Microsoft Purview compliance tenant. Users must be in scope for an active IRM policy to generate alerts - IRM does not monitor all users by default.

IRM Roles and Permissions

IRM uses dedicated role groups to maintain privacy and separation of duties between different participants in the investigation process:

Role Group	Permissions	Typical User
Insider Risk Management	Full access to all IRM features including policy creation, alert investigation, case management, and de-anonymization of users	IRM program owner
Insider Risk Management Admins	Create and manage policies; configure settings; cannot see alert details or de-anonymize	Security admin configuring IRM
Insider Risk Management Analysts	Access to alerts, cases, and user activity; can de-anonymize (if setting enabled); cannot create policies	SOC analyst, HR investigator
Insider Risk Management Investigators	Full investigative access: alerts, cases, user activity, content explorer within cases; can de-anonymize	Legal counsel, compliance investigator
Insider Risk Management Auditors	Read-only access to IRM audit log only	Internal auditor

The privacy protection in IRM is a key feature of its design. User activities show as pseudonyms (anonymous IDs) in alerts by default. Only users in Analyst or Investigator role groups can choose to de-anonymize (reveal the true name) when investigating a case. This protects user privacy until there is a legitimate investigative reason to identify the user.

Connectors and Data Sources

IRM can ingest signals from external HR and business systems via data connectors configured in the Purview compliance portal.

HR Connector

The HR connector imports employee data from your HR information system (Workday, ADP, SAP SuccessFactors, etc.) via CSV file upload to correlate with IRM risk indicators:

Resignation date: Triggers "data theft by departing employee" detection window
Last working day: Used as the trigger event for departing user policies
Performance notice: Can be used with "disgruntled employee" scenario policies
Job level / department: Enrichment data for risk scoring context

HR connector setup: configure a Microsoft Entra app registration, provide app credentials to the HR connector wizard, then schedule automated CSV uploads via PowerShell script or Logic App.

Physical Badging Connector

Imports physical access events (building entry/exit, after-hours access) from physical security systems to correlate with digital activities in IRM.

Other Available Connectors

Connector	IRM Use Case
Bloomberg Message	Import financial communication data for regulated industry compliance
ICE Chat / Refinitiv	Financial services communication monitoring
ServiceNow	IT ticket data for correlating admin activities with risk signals
Workday	HR events including resignations and performance data

Policy Templates

IRM policy templates provide pre-built detection logic for the most common insider risk scenarios. Each template defines which risk indicators to monitor and how to score user behavior.

Template	Signal Sources	Key Scenarios Detected
Data theft by departing employees	HR connector (resignation) + M365 activities + MDE	Bulk download, email to personal accounts, USB copy in 30-day window before last day
Data leaks	M365 activities + DLP alerts + MDE	Mass downloads, sharing to external parties, DLP policy bypasses
Data leaks by priority users	Same as data leaks but scoped to a priority user group	Higher risk scoring for C-suite, privileged admin accounts
Data leaks by risky users	M365 activities + Adaptive Protection risk level	Works in conjunction with Adaptive Protection risk levels
Security policy violations	MDE signals	Disabling MDE sensors, tampering with security settings
Offensive language in messages	Communication Compliance signals	Workplace harassment, discrimination, threatening content in Teams/email
Patient data misuse	EHR connector (Epic) + M365 activities	Healthcare-specific patient record access violations
Risky browser usage	Microsoft Edge browsing indicators	Access to job search sites, competitor sites, personal file hosting services

Policy templates require the appropriate signal sources to be configured. For example, "Data theft by departing employees" requires the HR connector to be set up and providing resignation dates - without it, IRM cannot detect the departure trigger window. Always verify that required connectors are active before enabling a dependent policy template.

Risk Indicators

Risk indicators are the specific activities that IRM monitors. They are organized into categories and can be enabled/disabled in IRM global settings. Enabling an indicator makes it available for inclusion in policy templates.

Indicator Categories

Office indicators: SharePoint/OneDrive downloads, email forwards, Teams message activities, label downgrade
Device indicators (requires MDE): USB copy, browser upload, printing sensitive files, screen capture
Microsoft Defender for Cloud Apps indicators: Third-party app file activities, anomalous downloads
Physical access indicators: Requires physical badging connector
Health record indicators: Requires EHR connector (Epic)
HR indicators: Performance notice received, put on leave
Risky browsing indicators: Requires Microsoft Edge (browser history access)

Indicators have a threshold setting - you can set how many occurrences of an activity in a given time window constitute a risk signal (e.g., "10 or more file downloads in a day").

Forensic Evidence

Forensic evidence is an optional IRM Premium feature that captures screen recordings of risky user activities on Windows managed devices, providing visual context for investigations.

Forensic Evidence Configuration

Enable forensic evidence in IRM settings (requires E5 Compliance or E5 Insider Risk Management add-on)
Create a forensic evidence policy defining which users to monitor and which activities trigger captures
Users selected for forensic evidence monitoring must be notified (privacy notice requirement)
The MDE sensor on the device captures screen recordings and uploads to the IRM case
Investigators with the IRM Investigators role can view the recordings in case details

Forensic Evidence Controls

Control	Description
Trigger conditions	Which activities start a recording: specific risk indicators, DLP policy match, or any IRM policy match
Capture bandwidth	Balance between capture resolution/frequency and device/network performance
Storage limit	Maximum storage per user per day for forensic captures
Privacy protections	Configuration to pause capture during certain app categories (password managers, banking apps, healthcare apps)

Forensic evidence is a high-sensitivity feature that must be handled carefully from a legal and HR perspective. Many organizations require documented HR and legal approval before deploying forensic evidence monitoring. The captures are stored in the Microsoft 365 compliance tenant and are accessible only to IRM Investigators role members. Review your local privacy laws before enabling this feature.

Adaptive Protection Integration

Adaptive Protection connects IRM risk scoring with DLP policy enforcement. As a user's IRM risk level increases due to risky behavior, the DLP policies applied to them become progressively stricter - without any manual intervention.

IRM Risk Levels for Adaptive Protection

Risk Level	Description	Typical DLP Response
Minor risk	Below threshold - normal user behavior	Standard DLP policy applies (audit only or allow with policy tip)
Moderate risk	Some signals indicate potential risk	DLP policy provides warning and requires justification for sensitive actions
Elevated risk	Multiple strong risk signals	DLP policy blocks sensitive actions (USB copy, external sharing of labeled files)

To view Adaptive Protection in action: in the Purview portal, navigate to Insider Risk Management - Adaptive Protection to see the current risk level distribution of users and the DLP policies linked to each level.

Adaptive Protection requires both IRM and DLP to be licensed and active. The IRM policy should be configured with Adaptive Protection enabled (in policy settings). The DLP policies need to include the condition "Insider risk level for the user is" with the desired level. Users move between risk levels automatically - you can view the timeline of risk level changes in the user activity page in IRM.

Defender for Endpoint Integration

Integrating Microsoft Defender for Endpoint (MDE) with IRM enriches insider risk detection with endpoint behavioral signals that would not be visible from cloud activity alone.

Endpoint Signals Available via MDE Integration

File copy to removable media (USB drives, SD cards)
File upload via browser (to personal cloud storage, file sharing sites)
Print of sensitive files (local and network printers)
Screen capture while accessing sensitive content
File copy to network share
Access to sensitive files by unallowed applications

Enabling MDE Integration

Go to Insider Risk Management - Settings - Microsoft Defender for Endpoint data sharing
Enable the toggle to allow IRM to receive endpoint signals from MDE
Devices must be onboarded to MDE (enrolled as managed endpoints)
Enable the relevant device activity indicators in IRM policy settings

MDE integration for IRM requires devices to be Intune-managed or MDE-onboarded with the relevant Purview information protection client installed. Pure BYOD devices without MDE enrollment cannot contribute endpoint signals to IRM. The integration is one-way: IRM reads signals from MDE; IRM does not send commands back to MDE to take device actions.

Search Tutorials