493756 – Microsoft Purview compliance portal: Insider Risk Management- Multi selectable DLP policies as an IRM triggering event

Product:

Purview, Purview Communication Compliance, Purview compliance portal, Purview Data Loss Prevention, Purview Information Protection, Purview Insider Risk Management

Platform:

Web, World tenant

Status:

Launched

Change type:

Links:

MC1143302

Details:

Insider Risk Management is releasing the ability to select multiple Data Loss Prevention (DLP) policies as triggering events in a policy. Previously, admins could only select one DLP policy as a triggering event within Insider Risk Management policies. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies based on their own internal policies, governance, and organizational requirements. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2025-05-21

updated:
2026-01-21

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Please, look at the most relevant linked item for details

explanation for non-techies**

Imagine you are managing a team of security guards in a large office building. Previously, each guard could only watch one security camera at a time, which made it challenging to catch any suspicious activity. Now, with the new update, each guard can monitor multiple cameras simultaneously. This change allows them to see a broader picture of what's happening in the building and respond more effectively to potential threats.

In the world of IT, Microsoft Purview's Insider Risk Management has introduced a similar enhancement. Previously, when setting up policies to monitor for insider risks like data leaks or security violations, administrators could only use one Data Loss Prevention (DLP) policy as a trigger. This was like having just one camera view to detect issues. Now, administrators can select multiple DLP policies as triggers, providing a more comprehensive view of potential risks.

This update is particularly useful for organizations that have complex internal policies and need to correlate different signals to identify risks. By using multiple DLP policies, organizations can better detect and respond to both intentional and accidental insider threats. Just as the security guards can now see more of the building at once, IT administrators can gain a clearer understanding of what's happening within their digital environment.

Moreover, Microsoft Purview ensures that this process respects user privacy. Just like security guards who follow strict protocols to respect the privacy of building occupants, the system pseudonymizes user data and employs role-based access controls. This means that while monitoring is more effective, it is also designed to protect individual privacy.

This change is now generally available, and organizations can start implementing it to enhance their risk management strategies. By having a more holistic view of potential risks, businesses can better protect their sensitive information and maintain a secure environment.