MC1102773 – Microsoft Purview | Insider Risk Management: Network-based detection of sensitive data sharing to cloud apps and Gen AI

Product:

Purview, Purview Communication Compliance, Purview compliance portal, Purview Information Protection, Purview Insider Risk Management

Platform:

Online, Web, World tenant

Status:

In development

Change type:

Admin impact, New feature, Updated message, User impact

Links:

484084

Details:

Summary:
Microsoft Purview Insider Risk Management will add network-based detection of sensitive data shared to cloud apps and Generative AI, rolling out from mid-2025 to early 2026. It enhances insider risk detection with privacy protections and requires admin configuration to enable network indicators in policies.

Details:
Updated October 7, 2025: We have updated the timeline. Thank you for your patience.
Microsoft Purview Insider Risk Management (IRM) is introducing enhanced detection capabilities that allow organizations to identify sensitive files and text shared to any cloud application or website-including Generative AI platforms-via the network layer. This capability is powered by integration with third-party network partners, enabling data capture at the network level.
IRM correlates signals to detect potential insider risks such as IP theft, data leakage, and policy violations. Built with privacy by design, IRM pseudonymizes users by default and includes role-based access controls and audit logs to help ensure user-level privacy.
This message is associated with Microsoft 365 Roadmap ID 484084.
[When this will happen:]
Public Preview: We will begin rolling out mid-July 2025 and expect to complete by late July 2025.
General Availability (Worldwide): We will begin rolling out mid-January 2026 and expect to complete by late January 2026.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2025-06-25

updated:
2025-10-07

Public Preview Start Date

XXXXXXX ... free basic plan only

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

linked item details

XXXXXXX ... free basic plan only

Pictures

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Increased Risk of Data Leakage
Without proper admin configuration, sensitive data may be inadvertently shared to cloud apps, leading to potential data breaches and compliance violations.
   - roles: IT Administrators, Compliance Officers
   - references: https://learn.microsoft.com/purview/insider-risk-management-settings-policy-indicators, https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=484084

User Confusion and Frustration
Users may be unaware of the new detection capabilities and policies, leading to confusion regarding what data can be shared and potential disruptions in their workflow.
   - roles: End Users, IT Support Staff
   - references: https://learn.microsoft.com/purview/dlp-network-data-security-learn, https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=484084

Compliance and Legal Risks
Failure to configure the new network indicators may result in non-compliance with data protection regulations, exposing the organization to legal penalties.
   - roles: Compliance Officers, Legal Advisors
   - references: https://learn.microsoft.com/purview/insider-risk-management-settings-policy-indicators, https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=484084

Configutation Options**

XXXXXXX ... paid membership only

Opportunities**

Enhanced Data Protection Policies
The new network-based detection capabilities allow organizations to strengthen their data protection policies by monitoring sensitive data shared through cloud applications and Generative AI. This can lead to better compliance with regulations and internal policies, thereby reducing the risk of data breaches.
   - next-steps: Review and update existing data protection policies to incorporate insights from the new detection capabilities. Train compliance and security teams on how to leverage these insights for policy enforcement.
   - roles: Compliance Officers, Data Protection Officers, Security Analysts
   - references: https://learn.microsoft.com/purview/insider-risk-management-settings-policy-indicators, https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=484084

Improved User Privacy Management
The integration of privacy by design, including pseudonymization and role-based access controls, enhances user privacy management. Organizations can better manage user data while ensuring compliance with privacy regulations, thus improving user trust and satisfaction.
   - next-steps: Implement training sessions for IT and HR departments on privacy management practices. Review current privacy policies to align with the new capabilities.
   - roles: IT Administrators, HR Managers, Privacy Officers
   - references: https://learn.microsoft.com/purview/dlp-network-data-security-learn, https://learn.microsoft.com/purview/insider-risk-management-settings-policy-indicators " target="_blank" rel="nofollow noopener noreferrer">https://learn.microsoft.com/purview/insider-risk-management-settings-policy-indicators

Proactive Insider Threat Detection
With the ability to detect insider risks like IP theft and data leakage at the network level, organizations can adopt a more proactive approach to security. This capability enables timely intervention and risk mitigation before incidents escalate.
   - next-steps: Establish a cross-departmental task force to analyze the data collected from the new detection capabilities. Create a response plan for potential insider threats identified through the system.
   - roles: Security Operations Center (SOC) Teams, Risk Management Officers, IT Security Managers
   - references: https://learn.microsoft.com/purview/insider-risk-management-settings-policy-indicators, https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=484084

Potentional Risks**

XXXXXXX ... paid membership only

Data Protection**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

Hypothetical Work Council Statement**

XXXXXXX ... paid membership only

DPIA Draft**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only