Communication Compliance in Microsoft Purview finds risky messages in email, Teams, Viva Engage and AI interactions: harassment, threats, leaked sensitive data, regulatory red flags and risky Copilot prompts. It's built for review by people, so the setup is as much about who reviews and what they can do as about detection. In this post I'll set up roles, scope, a first policy, privacy settings and the remediation workflow, and show how to test it.
Prerequisites#
- Subscription and region: check Microsoft's Communication Compliance licensing requirements; the solution is available only in regions that support its Azure dependencies. Detecting interactions with non-Microsoft 365 AI apps (such as Copilot Studio, Security Copilot or connected AI apps) needs pay-as-you-go billing; Microsoft 365 Copilot interactions don't.
- Audit log on: alerts and the record of reviewer actions depend on it (how to check).
- Reviewers: individual users (not groups) with Exchange Online mailboxes.
- Viva Engage must be in Native Mode to be checked.
Step-by-step#
1. Assign role groups with separation of duties#
Under Settings › Roles and scopes › Role groups in the Microsoft Purview portal:
| Role group | What members can do |
|---|---|
| Communication Compliance | Everything: policies, settings, investigation and remediation |
| Communication Compliance Admins | Create and manage policies and global settings, but not investigate alerts |
| Communication Compliance Analysts | Triage alerts for policies where they're reviewers |
| Communication Compliance Investigators | Investigate and remediate, including the Conversation and Translation views, Teams message removal, downloads and Power Automate flows |
| Communication Compliance Viewers | View and export policy updates |
Analysts and Investigators see alerts only for policies that list them as reviewers. Always keep at least one member in Communication Compliance or Communication Compliance Admins. Global, Compliance and Organization Management admins get admin rights, not review rights. More on roles: Purview roles and role groups.
2. Decide who is in scope#
Choose All users, selected users and groups, or an adaptive scope. Prefer distribution groups: a Microsoft 365 group only brings in messages sent to the group, not each member's own mail and chats. Dynamic distribution groups, nested distribution groups and dynamic Microsoft 365 groups aren't supported for scoping. Users with on-premises or third-party mailboxes need a distribution group for their Teams chats to be checked.
3. Create a policy from a template#
Go to Communication Compliance › Policies › Create policy and pick a template:
| Template | Channels | Detects |
|---|---|---|
| Detect inappropriate text | Exchange, Teams, Viva Engage | Threat, discrimination and targeted harassment classifiers (100% review) |
| Detect inappropriate content | Teams, Viva Engage | Hate, violence, sexual and self-harm content safety classifiers |
| Detect inappropriate images | Exchange, Teams | Adult and racy image classifiers |
| Detect sensitive info types | Exchange, Teams, Viva Engage | Sensitive info types, custom dictionaries, attachments over 1 MB (10% review) |
| Detect financial regulatory compliance | Exchange, Teams, Viva Engage | Money laundering, stock manipulation, gifts and entertainment and other regulatory classifiers (10% review) |
| Detect conflict of interest | Exchange, Teams, Viva Engage | Internal messages between two groups or users you pick |
| Detect Microsoft 365 Copilot and Microsoft 365 Copilot Chat interactions | Microsoft 365 Copilot and Copilot Chat | Prompt Shields (jailbreak attempts) and protected material in responses |
Set the name (it can't be changed), the users in scope and the reviewers, then select Customize policy if you want OCR for text in images, or Create policy. Roles scoped to admin units can only create custom policies.
4. Or build a custom policy#
With Custom policy you choose the locations (Exchange, Teams, Viva Engage, Microsoft Copilot experiences, Enterprise AI apps, Other AI apps, or third-party sources through a connector), the direction (inbound, outbound, internal) and the conditions: sensitive info types, keyword dictionaries and Microsoft's trainable classifiers (custom trainable classifiers aren't supported). Keep Filter out messages from email blasting services selected to drop newsletters and bulk mail. Before saving, select Test your conditions (preview) and paste sample messages to check classifier and sensitive info type matches.
5. Set privacy, notices and preservation#
Under Settings › Communication Compliance: on the Privacy tab, Show anonymized versions of usernames pseudonymizes names for reviewers; on Notice templates, create the reminder emails reviewers send; and Policy Match Preservation keeps copies of matched messages for 1 month, 6 months, 1 year (the default) or 7 years. A value set in a policy overrides the global one.
6. Review and remediate#
Reviewers open the policy's Pending tab. The yellow banner shows which condition matched, and the User activity view adds Insider Risk Management context. Then they pick an action:
- Resolve: close the item; for classifier false positives choose Item was misclassified. Cross-policy resolution (preview, on by default) resolves the same match in every policy.
- Tag as: Compliant, Noncompliant, Questionable or up to 10 custom tags per policy.
- Notify: email the sender using a notice template.
- Escalate: send the item to another reviewer on the policy.
- Escalate for investigation: create an eDiscovery (Premium) case with up to 100 messages; see eDiscovery cases.
- Remove message in Teams: recipients see a policy tip instead of the message; the sender can still see what was blocked.
- Power Automate: run a flow, such as the built-in template that notifies the user's manager.
Verify#
- As a scoped user, send a test email and a Teams chat that meet the policy's conditions.
- Policies scan hourly, but allow about 24 hours for email and 48 hours for Teams, Viva Engage and third-party sources before judging a test.
- On the Policies page, check Last policy scan and Messages scanned today. Zero or very low scan counts can mean the scope or locations are too narrow.
- As a reviewer, open Communication Compliance › Alerts, remediate the test item and confirm it moves to Resolved.
Tips & gotchas#
- No PowerShell: policies are managed only in the portal, and they can't be renamed.
- Storage limit: each policy holds up to 100 GB or 1 million messages, then deactivates. Copy it to keep coverage; deleting it permanently deletes its matches and alerts.
- User-reported messages: Teams users can report inappropriate chat messages into a built-in policy whose initial reviewers are Communication Compliance Admins or Global Admins. Assign proper reviewers right away.
- Insider Risk Management: the "risky users" templates can create a dedicated policy here; anyone sending five or more potentially risky messages within 24 hours comes into scope. See Insider Risk Management setup.
- DSPM for AI: policies prefixed "DSPM for AI" were created there, not here; see DSPM for AI.
- Compliance boundaries: if you use them, add Microsoft's documented security filter so admins and reviewers can reach the policy mailboxes.
