Published Aug 30, 2024
The Microsoft Purview compliance portal now integrates Insider Risk Management alerts within Communication Compliance triage flows, enhancing compliance risk assessment. Rollout begins mid-October 2024 for Public Preview and mid-November 2024 for General Availability. Organizations must enable 'Data sharing' in IRM settings to use this feature.
Updated September 30, 2024: We have updated the rollout timeline below. Thank you for your patience.
A new Microsoft Purview compliance portal introduces a pivotal communications enhancement that integrates Insider Risk Management (IRM) alerts within Communication Compliance (CC) triage flows, providing a holistic approach to compliance risk assessment. This integration empowers investigators with enriched insights by correlating communication alerts with a user's risk profile and activity history from IRM directly in a CC triage flow. This synergy between IRM and CC facilitates a more nuanced and informed decision-making process during investigations.
This message is associated with Microsoft 365 Roadmap ID 408534.
When this will happen:
Public Preview: We will begin rolling out mid-October 2024 (previously late September) and expect to complete by late October 2024 (previously mid-October)
General Availability (Worldwide): We will begin rolling out mid-November 2024 (previously mid-October and expect to complete by late November 2024 (previously late October).
How this will affect your organization:
The integration of IRM context into CC is a significant stride towards enhancing the efficacy of compliance investigations. This will allow investigators to view a user's risk profile and history alongside communication alerts, enabling a more informed and efficient triage process.
The insider risk severity (Low, Medium, or High) determined by activity detected in IRM policies helps to prioritize and respond to user activity accordingly. A new user activity timeline will show messages and activities from IRM in one screen, simplifying the review process.
What you need to do to prepare:
To use this feature, please connect with IRM administrators to enable Data sharing from IRM settings. If you don't turn this setting on, you will see Insider risk activity not available.