MC878431 - Microsoft Purview Communication Compliance: Enrich triage with Insider Risk Management context
Message Center
Metadata at Aug 30, 2024
Published
Service
Tag
Platforms
Metadata changes
- Tags
- Admin impact, New feature, Updated messageAdmin impact, New feature
- End date
- Mar 3, 2025Dec 31, 2024
Body changes
Updated December 30, 2024: We have updated the rollout timeline below. Thank you for your patience.
A new Microsoft Purview compliance portal introduces a pivotal communications enhancement that integrates Insider Risk Management (IRM) alerts within Communication Compliance (CC) triage flows, providing a holistic approach to compliance risk assessment. This integration empowers investigators with enriched insights by correlating communication alerts with a user's risk profile and activity history from IRM directly in a CC triage flow. This synergy between IRM and CC facilitates a more nuanced and informed decision-making process during investigations.
This message is associated with Microsoft 365 Roadmap ID 408534.
When this will happen:
Public Preview: We will begin rolling out mid-Novemberlate August 2024 (previously early November) and expect to complete by mid-November 2024 (previously late October)
September 2024.
General Availability (Worldwide): We will begin rolling out mid-DecemberSeptember 2024 (previously mid-November and expect to complete by late January 2025 (previously late December).September 2024.
How this will affect your organization:
The integration of IRM context into CC is a significant stride towards enhancing the efficacy of compliance investigations. This will allow investigators to view a user's risk profile and history alongside communication alerts, enabling a more informed and efficient triage process.
The insider risk severity (Low, Medium, or High) determined by activity detected in IRM policies helps to prioritize and respond to user activity accordingly. A new user activity timeline will show messages and activities from IRM in one screen, simplifying the review process.
What you need to do to prepare:
To use this feature, please connect with IRM administrators to enable Data sharing from IRM settings. If you don't turn this setting on, you will see Insider risk activity not available.
