483485 – Microsoft Purview compliance portal: Enhancements to global exclusions in IRM settings

Product:

Purview, Purview Communication Compliance, Purview compliance portal, Purview Information Protection, Purview Insider Risk Management

Platform:

Web, World tenant

Status:

Launched

Change type:

Links:

MC1058262

Details:

In this update, we are making the below enhancements to Insider Risk Management (IRM) exclusions to reduce alert noise. 1. Keyword logic update for email - An email will be excluded from scoring only when all the attachments match the keyword exclusions or email subject matches the keyword exclusions. This will be helpful to reduce the email signature noise which commonly contains keyword "image". 2. Keyword exclusions on both target and source file paths - For signals like file copied to removable media, keyword exclusions apply on both target and source file paths. 3. File path exclusions for removable media - We will start supporting file path exclusions for removable media. 4. Exclusion support for browser - Domain exclusions are now supported for browsing indicators. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies based on their own internal policies, governance, and organizational requirements. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2025-03-27

updated:
2026-01-21

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Please, look at the most relevant linked item for details

explanation for non-techies**

Imagine you have a security system in your office building that monitors all activities to ensure everything is safe and secure. This system is designed to alert you if something suspicious happens, like someone trying to access a restricted area. However, if the system is too sensitive, it might send alerts for every little thing, like someone walking by with a common object. This can create a lot of unnecessary noise, making it hard to focus on real threats.

In the world of IT, Microsoft Purview's Insider Risk Management (IRM) works similarly. It's like the security system for your digital environment, monitoring activities to prevent risks like data leaks or security breaches. However, just like in the office, too many alerts can become overwhelming and unhelpful.

To make this system more efficient, Microsoft has introduced some enhancements. For example, think of emails as packages being delivered. If every package with a certain label triggered an alert, you'd be overwhelmed. Now, the system only alerts you if all the contents of the package match certain criteria, reducing unnecessary alerts. This is similar to how email alerts are now managed by checking all attachments and the subject line for specific keywords before deciding if an alert is necessary.

Additionally, imagine if you could exclude certain areas from being monitored because you know they're safe, like a trusted delivery entrance. Microsoft has extended this idea to file paths, meaning that files moved to or from certain locations can be excluded from alerts if they're deemed safe.

Lastly, consider how a web browser is like a window to the internet. Previously, any activity through this window might have triggered an alert. Now, you can exclude certain trusted websites from being monitored, reducing unnecessary alerts for known safe domains.

These changes help focus attention on real risks, much like how a well-tuned security system in a building helps focus on genuine threats, ensuring the safety and security of the environment without unnecessary distractions.