466742 – Microsoft Purview compliance portal: Insider Risk Management – Downgrade/remove sensitivity label

Product:

Azure Information Protection, Microsoft 365 Apps, OneDrive, Purview, Purview Communication Compliance, Purview compliance portal, Purview Information Protection, Purview Insider Risk Management, SharePoint

Platform:

Web, World tenant

Status:

Launched

Change type:

Links:

MC934733

Details:

This feature is an enhancement to the existing IRM Office Indicator - Downgrading sensitivity labels applied to SharePoint files and removing sensitivity labels from SharePoint files. In the current version, only sensitivity label changes on SharePoint Web app are captured in IRM. But with the latest update, this indicator captures the sensitivity label changes (downgrade/remove) when performed on OneDrive, AIP, and Endpoint (SharePoint file opened in Office app or any sensitivity label change on the local files on your device). Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies based on their own internal policies, governance and organizational requirements. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2024-11-05

updated:
2026-01-21

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Please, look at the most relevant linked item for details

explanation for non-techies**

Imagine you have a large office with many filing cabinets, each containing sensitive documents. Each document has a label indicating its level of sensitivity, like "Top Secret," "Confidential," or "Public." Now, imagine you have a system in place that monitors who changes these labels, when they do it, and why. This is similar to what Microsoft Purview's Insider Risk Management does for digital files.

In the digital world, sensitivity labels are used to protect information by indicating how sensitive a document is and how it should be handled. These labels can be applied to files stored in places like SharePoint or OneDrive, which are like digital filing cabinets. Previously, the system only tracked changes to these labels when they were made directly on the SharePoint website. However, with the latest update, the system now also tracks changes made on OneDrive, through the Azure Information Protection (AIP) service, and even on local files on your computer when they are opened in Office apps.

This enhancement is like upgrading your office monitoring system to not only track label changes made directly at the filing cabinet but also those made when someone takes a document to their desk or another office location. It helps organizations keep an eye on potential risks, such as someone intentionally or accidentally mishandling sensitive information, which could lead to data leaks or security breaches.

The system is designed with privacy in mind, ensuring that users' identities are protected through pseudonymization, meaning their real names are hidden. Access to this information is controlled based on roles, and all actions are logged for auditing purposes. This way, organizations can create and enforce policies that align with their internal rules and regulations, much like how a company might have specific guidelines for handling physical documents.