365Fanatic / Microsoft 365 Message Center / MC1387681
Tenant announcements

(Updated) Microsoft Purview | Insider Risk Management: Policy recommendation panel in IRM

MC1387681

All Microsoft 365 Message Center posts · Daily summary

SummaryDetailedTimelineProduct updatesThis weekMC SummaryMC DetailedPnP Search
About this page These posts come from a tenant in West Europe and are shown as a reference. Day-by-day digest: MC Summary. Linked to the roadmap via Roadmap ID when Microsoft names one. Items are kept for 12 months. Always check Message Center in your own environment for what applies to you.
Archive This post is no longer in the Microsoft 365 Message Center (last seen on 9 okt 2026). Microsoft removes posts after a while. We keep the last version here as an archive.
MC1387681
Microsoft Purview
Linked · 1 roadmap itemTimeline
Show roadmap information (1)
#560600In development
Microsoft Purview: Insider Risk Management – Policy Recommendation Panel in IRM
Preview availableJanuary 2027Rollout startFebruary 2027

Added to roadmap: 28 apr 2026 | Last modified: 29 sep 2026

Today, Insider Risk Management (IRM) provides policy-driven protection for data leaks, data theft, and risky AI usage. However, while policy-driven protections are powerful, customers may not always have clear visibility into where coverage can be optimized or expanded to address latent insider risk. IRM now provides guidance on what protections are missing or which policy configurations deliver the most incremental…

Updated September 29, 2026: We have updated the timeline. Thank you for your patience.

What and why

Microsoft Purview Insider Risk Management is introducing a policy recommendation panel to help administrators identify gaps in insider risk coverage and strengthen protections. While policies provide protection against insider risks, organizations may not always have visibility into missing or high-value configurations. This enhancement provides guidance on which policies are missing or offer the most incremental value, using analytics to generate actionable recommendations that improve coverage across scenarios such as data leakage, data theft, risky AI usage, IP theft, and security violations.

Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent risks. It enables organizations to define policies based on their governance needs and is built with privacy by design, including pseudonymization by default, role-based access controls, and audit logging to help protect user privacy.

This message is associated with Microsoft 365 Roadmap ID 560600.

Rollout schedule

  • Public Preview: Rolling out mid-January 2027 (previously late November 2026) through late January 2027 (previously mid-December 2026).
  • General Availability (Worldwide): Rolling out mid-February 2027 (previously mid-December 2026) and expected to complete by late February 2027 (previously mid-January )

Impact on your organization

Who is affected

Platforms/Services

  • Microsoft Purview Insider Risk Management (web experience)

What will happen

  • A new Policy Recommendation panel will be available on the Policies page.
  • The panel will analyze existing policies and identify potential gaps in coverage.
  • Administrators will receive recommendations to create policies addressing risks such as data leakage, data theft, and risky AI usage.
  • The feature is enabled by default and available automatically as part of the rollout.
  • Existing policies and configurations remain unchanged.
  • There is no impact to user workflows.

Action Required/Recommendations

No action is required.

Recommended actions:

  • Review recommendations in the Policy Recommendation panel.
  • Evaluate suggested policies to improve insider risk coverage.
  • Update internal governance or risk management processes as needed.
  • Communicate this enhancement to security and compliance teams.

Compliance considerations

QuestionAnswerDoes the change alter how existing customer data is processed, stored, or accessed (for example, documents, emails, or chats)? If so, how and to what extent?Yes. The feature analyzes existing policy configurations and organizational signals within Insider Risk Management to generate recommendations, which introduces additional processing of customer data signals.Does the change introduce or significantly modify AI or machine learning capabilities that interact with or provide access to customer data? If so, summarize the changes.Yes. The policy recommendation panel uses analytics-driven intelligence to identify gaps in policy coverage and generate recommendations based on correlated signals.Does the change alter how admins can monitor, report on, or demonstrate compliance activities, for example in Microsoft Purview or admin reporting? If so, summarize the changes.Yes. Administrators gain enhanced visibility into policy coverage gaps and recommendations, improving their ability to monitor and manage insider risk compliance activities.

This is in the weekly digest for week 40 · What changed this week? →