475057 – Microsoft Purview compliance portal: Insider Risk Management- DLP alerts as indicators

Product:

Purview, Purview Communication Compliance, Purview compliance portal, Purview Information Protection, Purview Insider Risk Management

Platform:

US Instances, Web, World tenant

Status:

Launched

Change type:

Links:

MC990961

Details:

IRM admins can now select DLP alerts as indicators in IRM policies. IRM admins can select DLP policies that they would like to bring into IRM. By enabling this indicator, admins can detect if a user has alerts for the pre-selected DLP policies. When an IRM alert is generated, admin can see if there are any high-risk alerts for this user within DLP for the policies that are enabled as indicators. This feature will help admins view this information within IRM itself without having to switch to DLP. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies based on their own internal policies, governance, and organizational requirements. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2025-01-22

updated:
2026-01-21

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Please, look at the most relevant linked item for details

explanation for non-techies**

Microsoft has introduced a new feature in its Purview compliance portal that allows Insider Risk Management (IRM) administrators to use Data Loss Prevention (DLP) alerts as indicators within IRM policies. To put it simply, think of DLP alerts as early warning signs or flags that help identify potential risks within an organization. By integrating these alerts into IRM, administrators can now see if a user has triggered any high-risk alerts for specific DLP policies directly within the IRM dashboard. This means they don't have to switch back and forth between different systems to gather this information.

Imagine you're managing a team of security guards at a museum. Each guard is responsible for watching over different sections of the museum. If one guard notices something suspicious, like someone trying to take a painting off the wall, they can raise an alert. Previously, you would have to check with each guard individually to gather all the alerts and piece together the overall security situation. Now, with this new feature, it's like having a central control room where all the guards' alerts are automatically displayed on a single screen. This allows you to quickly assess the situation and take action if needed.

In the context of Microsoft Purview, this central control room is the IRM dashboard, where administrators can see all relevant alerts and signals that might indicate insider risks, such as data theft or unauthorized data sharing. The system is designed with privacy in mind, ensuring that users' identities are protected through pseudonymization, and access to this sensitive information is controlled through role-based permissions. This approach helps organizations maintain a balance between monitoring for potential risks and respecting user privacy.