MC878431 - Microsoft Purview Communication Compliance: Enrich triage with Insider Risk Management context
Service
Last Updated
Published Aug 30, 2024
Tag
Platforms
Summary
The Microsoft Purview compliance portal is updated to integrate Insider Risk Management alerts within Communication Compliance triage flows, enhancing compliance risk assessment. Rollout begins mid-November 2024 for Public Preview and mid-December 2024 for General Availability. Organizations must enable Data sharing in IRM settings to prepare.
More information
Updated December 30, 2024: We have updated the rollout timeline below. Thank you for your patience.
A new Microsoft Purview compliance portal introduces a pivotal communications enhancement that integrates Insider Risk Management (IRM) alerts within Communication Compliance (CC) triage flows, providing a holistic approach to compliance risk assessment. This integration empowers investigators with enriched insights by correlating communication alerts with a user's risk profile and activity history from IRM directly in a CC triage flow. This synergy between IRM and CC facilitates a more nuanced and informed decision-making process during investigations.
This message is associated with Microsoft 365 Roadmap ID 408534.
When this will happen:
Public Preview: We will begin rolling out mid-November 2024 (previously early November) and expect to complete by mid-November 2024 (previously late October)
General Availability (Worldwide): We will begin rolling out mid-December 2024 (previously mid-November and expect to complete by late January 2025 (previously late December).
How this will affect your organization:
The integration of IRM context into CC is a significant stride towards enhancing the efficacy of compliance investigations. This will allow investigators to view a user's risk profile and history alongside communication alerts, enabling a more informed and efficient triage process.
The insider risk severity (Low, Medium, or High) determined by activity detected in IRM policies helps to prioritize and respond to user activity accordingly. A new user activity timeline will show messages and activities from IRM in one screen, simplifying the review process.
What you need to do to prepare:
To use this feature, please connect with IRM administrators to enable Data sharing from IRM settings. If you don't turn this setting on, you will see Insider risk activity not available.