MC878431 - Microsoft Purview Communication Compliance: Enrich triage with Insider Risk Management context

Updated DecemberSeptember 30, 2024: We have updated the rollout timeline below. Thank you for your patience.

A new Microsoft Purview compliance portal introduces a pivotal communications enhancement that integrates Insider Risk Management (IRM) alerts within Communication Compliance (CC) triage flows, providing a holistic approach to compliance risk assessment. This integration empowers investigators with enriched insights by correlating communication alerts with a user's risk profile and activity history from IRM directly in a CC triage flow. This synergy between IRM and CC facilitates a more nuanced and informed decision-making process during investigations. 

This message is associated with Microsoft 365 Roadmap ID 408534.

When this will happen:

Public Preview: We will begin rolling out mid-NovemberOctober 2024 (previously early November)late September) and expect to complete by mid-Novemberlate October 2024 (previously late mid-October)

General Availability (Worldwide): We will begin rolling out mid-DecemberNovember 2024 (previously mid-NovemberOctober and expect to complete by late January 2025November 2024 (previously late December)October).

How this will affect your organization:

The integration of IRM context into CC is a significant stride towards enhancing the efficacy of compliance investigations. This will allow investigators to view a user's risk profile and history alongside communication alerts, enabling a more informed and efficient triage process.

The insider risk severity (Low, Medium, or High) determined by activity detected in IRM policies helps to prioritize and respond to user activity accordingly. A new user activity timeline will show messages and activities from IRM in one screen, simplifying the review process.

What you need to do to prepare:

To use this feature, please connect with IRM administrators to enable Data sharing from IRM settings. If you don't turn this setting on, you will see Insider risk activity not available.