HANDS ON SharePoint
HANDS ON Teams
HANDS ON Lists
HANDS ON tek
M365 Admin
Microsoft Purview compliance portal: Insider Risk Management – Entra compromised user signals in IRM
With this feature, IRM analysts can identify if the user being investigated has any compromise user alerts in Microsoft Entra. This will help them formulate the right response action, like escalating the Incident to SOC teams for quick remediation, etc. Microsoft Entra offers two types of compromised user detections:
1. Sign in risk detections – Compromise risk associated with a specific sign-in.
2. User risk detections – Compromise risk associated with a specific user. – Insider risk management admins can opt into each of the above risk detections from Insider risk management global settings. – Risk detections will be available in the indicator timeline within the alert investigation experience. – Risk detections will not impact the risk score or severity of Insider risk management alerts.
Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies based on their own internal policies, governance, and organizational requirements.
Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.
More info: https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks
| Product | |
|---|---|
| Release phase | General Availability |
| Release date | February CY2025 Preview date: October CY2024 |
| Platform | Web |
| Cloud Instance | Worldwide (Standard Multi-Tenant) |
| Created | 2024-10-09 |
| Roadmap ID | 420938 |
| Roadmap Link | https://www.microsoft.com/microsoft-365/roadmap?featureid=420938 |
