483520 – Microsoft Purview compliance portal: New email indicators to alert on exfiltration of business sensitive data to free public

Product:

Purview, Purview Communication Compliance, Purview compliance portal, Purview Insider Risk Management

Platform:

Web, World tenant

Status:

Launched

Change type:

Links:

MC1051101

Details:

In this update, we are adding two new email indicators to Insider Risk Management. 1. Sending email with attachments to free public domains: This alerts when business-sensitive data is potentially leaked from a work email account to a free public domain email, potentially leading to a data security incident. 2. Sending email with attachments to self: This alerts when business-sensitive data is potentially leaked from a work email account to user's personal email account or emailing self, potentially leading to a data security incident. Admins with appropriate permissions can enable these indicators from the settings page and use these new indicators in the data leaks or data theft policy template. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies based on their own internal policies, governance, and organizational requirements. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2025-03-11

updated:
2026-01-21

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Please, look at the most relevant linked item for details

explanation for non-techies**

Imagine your company as a secure office building. In this building, you have valuable documents that need to be protected. Now, think of emails as a way to send these documents out of the building. Microsoft Purview's new update acts like a security guard who watches the doors to ensure that these documents aren't leaving the building inappropriately.

The first new feature is like a guard who checks if anyone is trying to send important documents to an untrusted location, like a public park, which represents free public email domains like Gmail or Yahoo. If someone tries to send a sensitive document to one of these places, the guard raises an alert. This helps prevent sensitive information from accidentally or intentionally being shared with people outside the company who shouldn't have access to it.

The second feature is like a guard who notices if someone is trying to sneak a document out by sending it to their own personal mailbox, like taking it home without permission. This alert helps ensure that employees aren't moving sensitive information to their personal accounts, which could lead to a security breach.

These alerts are part of a larger system that looks for unusual or risky behavior, much like a security team that monitors for any suspicious activity within the building. The system is designed to respect privacy, meaning it doesn't reveal personal details unless necessary, similar to how a security team would handle situations discreetly and professionally.

Overall, these new email indicators are tools to help protect your company's valuable information, ensuring it stays safe and secure, just like how a well-guarded building keeps its important documents protected.