394281 – Microsoft Purview compliance portal: Insider Risk Management – Risky AI usage

Product:

Copilot, Purview Communication Compliance, Purview Insider Risk Management

Platform:

Web, World tenant

Status:

In development

Change type:

Links:

MC947048

Details:

With this update, Insider risk management will help admins identify risky AI usage. We are adding new detections of intentional and unintentional insider risk activity on generative AI apps that can pose a risk to an organization. Activities will include risky prompts containing sensitive info or risky intent and sensitive responses containing sensitive info or is generated from sensitive files or sites. Coverage will span across Microsoft Copilots and 3P generative AI apps. These detections will also contribute to Adaptive Protection insider risk levels. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies based on their own internal policies, governance, and organizational requirements. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
Preview, General Availability

Created:
2024-04-23

updated:
2024-10-24

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

Direct effects for Operations**

- Direct Impact on IT Operations
- Increased Monitoring Requirements
- IT administrators will need to enhance monitoring protocols to track risky AI usage effectively.
- Role Impacted: IT Security Administrators
- Reference: [Microsoft Insider Risk Management](https://learn.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management?view=o365-worldwide)

- Potential System Performance Issues
- The implementation of new detection mechanisms may lead to increased load on existing systems, potentially affecting performance.
- Role Impacted: IT Operations Managers
- Reference: [Microsoft Purview Compliance Portal](https://learn.microsoft.com/en-us/microsoft-365/compliance/purview-compliance-portal?view=o365-worldwide)

- Direct Impact on IT Services
- Changes in Compliance Reporting
- New compliance reports will need to be generated and analyzed, which may require additional resources and training for staff.
- Role Impacted: Compliance Officers
- Reference: [Microsoft Compliance Solutions](https://learn.microsoft.com/en-us/microsoft-365/compliance/compliance-solutions?view=o365-worldwide)

- Direct Impact on IT Users
- User Awareness and Training
- Employees will need to be educated on the implications of using generative AI tools and the potential risks associated with sensitive information.
- Role Impacted: All Employees
- Reference: [Microsoft AI and Compliance](https://learn.microsoft.com/en-us/microsoft-365/compliance/ai-compliance?view=o365-worldwide)

- Direct Impact on IT Administrators
- Policy Development and Enforcement
- IT administrators will need to develop and enforce new policies regarding the use of generative AI tools, which may require additional time and resources.
- Role Impacted: IT Policy Managers
- Reference: [Microsoft Purview Insider Risk Management Policies](https://learn.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management-policies?view=o365-worldwide)

Opportunities**

XXXXXXX ... free basic plan only

Potentional Risks**

XXXXXXX ... paid membership only

Data Protection**

XXXXXXX ... paid membership only

Hypothetical Work Council Statement**

XXXXXXX ... paid membership only

DPIA Draft**

XXXXXXX ... paid membership only