489838 – Microsoft Purview Compliance Portal: Custom CC policy as IRM indicator

Product:

Purview, Purview Communication Compliance, Purview compliance portal, Purview Information Protection, Purview Insider Risk Management

Platform:

Web, World tenant

Status:

Launched

Change type:

Links:

MC1074097

Details:

IRM admins can now select any Communication Compliance (CC) Policy alerts as indicators in IRM policies. After this rollout, IRM admins can select any custom CC policies that they would like to bring into IRM and detect if a user has alerts for these CC policies. When an IRM alert is generated, admins can review if there are any alerts for the user within CC under the policies that are enabled as indicators. This feature will help admins and analysts view this information in IRM without switching to CC. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies to manage security and compliance. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2025-05-02

updated:
2026-01-21

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Please, look at the most relevant linked item for details

explanation for non-techies**

Imagine you are a detective trying to solve a mystery, and you have different sources of information to help you. You have one source that tells you about suspicious communications, like emails or messages that might indicate something fishy is going on. This is like the Communication Compliance (CC) part of Microsoft Purview. Then, you have another source that gives you clues about potential insider threats, like someone in your organization doing something they shouldn't, such as stealing information or breaking security rules. This is what Insider Risk Management (IRM) does.

Now, what if you could combine these two sources of information to get a clearer picture of what's happening? That's exactly what Microsoft Purview is doing with its new feature. IRM admins can now use alerts from CC policies as indicators in their IRM policies. Think of it like being able to take notes from your communication source and directly use them in your insider threat investigation without having to go back and forth between different notebooks.

With this new capability, if an IRM alert pops up, admins can quickly check if there are any related alerts from the CC policies for the same user. It's like having a magnifying glass that lets you see all the relevant clues in one place, making it easier to connect the dots and understand the full story.

Additionally, Microsoft Purview ensures that privacy is respected throughout this process. Just like a detective would keep sensitive information confidential, the system uses pseudonyms and has strict access controls to protect user privacy. This means that while you're piecing together the puzzle, you're also ensuring that personal details are kept secure and only accessible to those who need to know.

In summary, this integration is like having a more efficient detective toolkit, allowing you to gather and analyze information more effectively while maintaining privacy and security.