Today, Insider Risk Management (IRM) provides policy-driven protection for data leaks, data theft, and risky AI usage. However, while policy-driven protections are powerful, customers may not always have clear visibility into where coverage can be optimized or expanded to address latent insider risk. IRM now provides guidance on what protections are missing or which policy configurations deliver the most incremental value, providing customers with more comprehensive coverage to mitigate their most critical insider risk. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies based on their own internal policies, governance, and organizational requirements. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.
Show Message Center information (1)
Updated September 29, 2026: We have updated the timeline. Thank you for your patience.
What and why
Microsoft Purview Insider Risk Management is introducing a policy recommendation panel to help administrators identify gaps in insider risk coverage and strengthen protections. While policies provide protection against insider risks, organizations may not always have visibility into missing or high-value configurations. This enhancement provides guidance on which policies are missing or offer the most incremental value, using analytics to generate actionable recommendations that improve coverage across scenarios such as data leakage, data theft, risky AI usage, IP theft, and security violations.
Added to roadmap: 28 apr 2026 | Last modified: 29 sep 2026
This is in the weekly digest for week 40 · What changed this week? →
