Insider Risk Management in Microsoft Purview correlates signals from Microsoft 365, devices and HR systems to spot data theft, leaks and security violations by people inside the organization. Policies stay silent when a prerequisite is missing, so the order of setup matters. In this post I'll go through the setup in the order that works: permissions, audit and analytics, settings, the HR connector, the first policy and the first alerts.
Prerequisites#
- Licensing and region: confirm your subscription against Microsoft's Insider Risk Management licensing requirements (Microsoft points to a Microsoft 365 E5 trial if you want to evaluate it). Some indicators work only after you turn on pay-as-you-go billing, and the solution is available only in regions that support its Azure service dependencies.
- Legal and HR agreement: Microsoft requires customers to run their own full investigation and use the solution lawfully. Agree scope and reviewers with HR and legal (and any works council) first.
- Auditing on: policies and analytics read the unified audit log. It's on by default; check it as shown in searching the audit log.
Step-by-step#
1. Assign the role groups#
In the Microsoft Purview portal, open Settings › Roles and scopes › Role groups. Insider Risk Management covers everything; Insider Risk Management Admins configures settings and policies; the Analysts, Investigators and Auditors groups split triage, deep investigation and oversight so no one person needs every right. Recommended actions on the Overview page need Insider Risk Management or Insider Risk Management Admins. If the solution is missing from your portal, see Purview roles and permissions.
2. Run an analytics scan first#
Analytics shows where risk concentrates before any policy exists. Go to Insider Risk Management › Overview, find the Scan for insider risks in your organization card and select Run scan (or turn on Scan your tenant's user activity to identify potential insider risks under Settings › Analytics). Results can take up to 48 hours. With analytics on, the policy wizard can also suggest indicator thresholds in real time.
3. Configure the global settings#
Settings apply to every policy, so set them before the first one:
- Privacy: users are pseudonymized by default. Keep it that way unless HR and legal agree otherwise.
- Policy indicators: turn on the Office, device and other indicators you plan to use. Indicators that aren't on here can't be selected in a policy. Device indicators need devices onboarded to Purview, as for endpoint DLP. Cloud indicators for Box, Dropbox, Google Drive, Amazon S3 and Azure (preview) need those apps connected in Microsoft Defender first.
- Priority user groups: required for the "by priority users" templates. Turn on the priority user risk score booster under Policy indicators.
4. Feed in HR data#
HR data drives the departing-user templates (resignation dates) and the risky-user templates (job level changes, performance reviews and improvement plans); Patient data misuse also needs it. Departing-user templates can use the User account deleted from Microsoft Entra trigger instead, and risky-user templates can use Communication Compliance signals.
- Export a CSV from your HR system. You map the column names later; dates use ISO 8601. One file takes up to 500 records, so split larger exports.
- Register an app in Microsoft Entra ID and note the application ID, a client secret and the tenant ID.
- With the Data Connector Admin role, go to Settings › Data connectors › My connectors › Add connector, choose HR, pick the scenarios, map the columns and copy the job ID.
- Allow
webhook.ingestion.office.comthrough your firewall, then run Microsoft's sample upload script from GitHub (upload_termination_records.ps1).
UserPrincipalName,ResignationDate,LastWorkingDate
lena@contoso.com,2026-10-01T09:00:00Z,2026-10-30T17:00:00Z.\upload_termination_records.ps1 -tenantId <tenant-id> -appId <app-id> `
-appSecret <client-secret> -jobId <job-id> -filePath 'D:\HR\resignations.csv'Good looks like Upload Successful. Schedule the export and upload daily (Task Scheduler or Microsoft's Power Automate template) so departures arrive on time. A LastWorkingDate can't be more than six months in the past or a year in the future at upload time.
5. Create the first policy#
Go to Insider Risk Management › Policies › Create policy and pick a template. A sensible first choice:
| Goal | Template | What it needs |
|---|---|---|
| Leavers taking data | Data theft by departing users | HR connector or the Entra account deletion trigger |
| Leaks by anyone | Data leaks | A DLP policy with High severity incident reports, or exfiltration indicators as triggers |
| Risky AI prompts | Risky AI usage | Insider risk extension in Edge or the Microsoft Purview extension in Chrome |
| Malware or disabled protection | Security policy violations | Defender for Endpoint with the Insider Risk Management integration turned on in its advanced features |
In the wizard, the name can't be changed later. Scope to Include all users and groups if you want real-time threshold analytics; guest accounts aren't supported. Optionally add content to prioritize (SharePoint sites, sensitivity labels, sensitive info types, trainable classifiers, up to 50 file extensions). Finally, choose triggers and indicators, keep the default thresholds for a first policy and select Submit.
Watch out: a DLP policy used as a trigger must set incident reports to High; Low and Medium never create insider risk alerts. Alerts that come only from endpoint DLP, Teams DLP or Microsoft 365 Copilot DLP aren't evaluated by that indicator, and only users in scope of both policies count.
6. Triage the first alerts#
Alerts from activity indicators start after about 24 hours. Open the Alerts dashboard, review the activity, then confirm the alert into a case or dismiss it. A case can go to legal review in an eDiscovery case.
Verify#
- HR data: in Settings › Data connectors › My connectors, open the connector and select Download log under Progress.
RecordsSavedshould equal the rows you uploaded. - Scope: the Users in scope column on the Policies page shows who is actively scored. Users without a triggering event aren't evaluated unless you add them manually on the Users dashboard, which is also the quickest way to test with a pilot account.
- Alerts: after test activity by the pilot user (for example, copying labeled files to USB on an onboarded device), good looks like scored activity within about a day and an alert once thresholds are met.
Tips & gotchas#
- Adaptive Protection turns insider risk levels into stricter DLP and Conditional Access for risky users only; see Adaptive Protection.
- Communication Compliance can feed the "risky users" templates instead of, or alongside, HR data; see Communication Compliance setup.
- AI risk: the Risky AI usage policy can also be created in one click from DSPM for AI.
- Collection policies win: if a collection policy filters out a device activity, Insider Risk Management never sees it.
- Limits: each template supports up to 100 policies, and each template has a cap on scored users; performance drops near the cap.
- Secrets: Microsoft's Power Automate template can read the app secret from Azure Key Vault; with Task Scheduler the secret sits in the task's arguments, so lock that server down.
