518291 – Microsoft Purview: Insider Risk Management – Enhancements to variant limits and detection groups

Product:

Purview, Purview Communication Compliance, Purview compliance portal, Purview Insider Risk Management

Platform:

Web, World tenant

Status:

In development

Change type:

Links:

MC1194606

Details:

Microsoft Purview Insider Risk Management variant limit is being increased from 3 to 10 per indicator and an overall limit of 100 across all indicators. Along with this, the number of items in one detection group is being increased from 200 to 500. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies based on their own internal policies, governance, and organizational requirements. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2025-10-24

updated:
2025-11-19

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Please, look at the most relevant linked item for details

explanation for non-techies**

Imagine you're running a large law firm, and you have several departments, each with its own set of rules and ways of working. Now, let's say you want to ensure that everyone is following these rules and not accidentally or intentionally sharing sensitive information outside the firm. Microsoft Purview Insider Risk Management is like having a team of highly skilled detectives who are constantly on the lookout for any unusual behavior that might indicate a risk to your firm's confidential information.

Recently, Microsoft has made some updates to this detective team. Think of it like giving them more tools and expanding their ability to monitor and catch potential issues. Previously, these detectives could only keep an eye on a limited number of suspicious activities, or "variants," at a time. Now, they can watch up to 10 different activities per indicator, with a total of 100 across all indicators. This means they can cover more ground and be more effective in spotting potential risks.

Additionally, these detectives used to work in smaller groups, monitoring up to 200 items at a time. With the recent changes, they can now handle up to 500 items in one group. This is like expanding their team so they can keep track of more activities simultaneously, making it less likely for something important to slip through the cracks.

The purpose of these enhancements is to help organizations like yours create policies that align with your internal rules and governance needs. The system is designed with privacy in mind, ensuring that any monitoring respects user privacy by pseudonymizing user data and implementing role-based access controls. This means that while the detectives are doing their job, they are also careful not to invade anyone's privacy unnecessarily.

In summary, these updates to Microsoft Purview Insider Risk Management are like upgrading your security team with more resources and better tools, allowing them to do their job more effectively while respecting the privacy of everyone involved.