MC1221449 – Microsoft Purview: Insider Risk Management – Quick policy to detect data theft from non-Microsoft 365 data sources

Product:

Entra, Fabric, Purview, Purview Communication Compliance, Purview compliance portal, Purview Insider Risk Management

Platform:

Online, Web, World tenant

Status:

Launched

Change type:

New feature, User impact, Admin impact

Links:

543244

Details:

Summary:
A new quick policy template in Microsoft Purview Insider Risk Management will help detect data theft from Microsoft Fabric and non-Microsoft 365 cloud sources like Box, Dropbox, Google Drive, Azure, and AWS. It requires minimal setup, is not enabled by default, and rolls out worldwide in late February 2026.

Details:
[Introduction]
We're adding a new preconfigured quick policy template in Insider Risk Management to help detect potential data theft from Microsoft Fabric and other non-Microsoft 365 cloud storage services, including Box, Dropbox, Google Drive, Azure, and Amazon Web Services (AWS). This template helps admins create scenario-specific policies with minimal configuration, enabling faster and more consistent onboarding.
This message is associated with Microsoft 365 Roadmap ID 543244.
[When this will happen]
General Availability (Worldwide): We will begin rolling out in late February 2026 and expect to complete by late February 2026.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2026-01-23

updated:
2026-01-23

Public Preview Start Date

XXXXXXX ... free basic plan only

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

linked item details

XXXXXXX ... free basic plan only

Pictures

XXXXXXX ... free basic plan only

summary for non-techies**

Microsoft's new feature in Purview Insider Risk Management introduces a quick policy template to detect potential data theft across cloud services like Microsoft Fabric, Box, Dropbox, Google Drive, Azure, and AWS, particularly useful for monitoring employees leaving the company.

Direct effects for Operations**

Insider Risk Management Policy Deployment
If the new quick policy template is deployed without proper preparation, it may lead to an overwhelming number of alerts due to insufficient tuning, causing alert fatigue among admins and potentially missing critical incidents.
   - roles: Insider Risk Management Admins, IT Security Team
   - references: https://learn.microsoft.com/purview/insider-risk-management-policies#quick-policies, https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=543244

Integration with Non-Microsoft Cloud Services
Failure to ensure relevant connectors and integrations are enabled before deployment may result in incomplete monitoring of data theft activities across non-Microsoft cloud services, leading to undetected risks.
   - roles: Cloud Integration Admins, Data Governance Officers
   - references: https://learn.microsoft.com/purview/insider-risk-management-policies#quick-policies, https://sip.purview.microsoft.com/insiderriskmgmt/overviewpage?tid=72f988bf-86f1-41af-91ab-2d7cd011db47

Configutation Options**

XXXXXXX ... paid membership only

Data Protection**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only