Insider Risk Management in Microsoft 365

Microsoft 365 Insider Risk Management (IRM) is a compliance solution in Microsoft Purview that helps organizations detect, investigate, and act on risky user activities from internal users. Unlike external threat protection (e.g., Microsoft Defender for Office 365), IRM focuses on the insider threat: employees, contractors, or partners who have authorized access but may misuse it—intentionally or accidentally. The solution correlates signals across Microsoft 365 services (Exchange Online, SharePoint Online, Teams, Microsoft 365 Defender, etc.) to identify patterns indicative of data theft, policy violations, or security incidents.

IRM was introduced in 2021 as part of Microsoft's broader compliance portfolio. It is designed to address scenarios like: a departing employee exfiltrating data, a user sharing sensitive files with external parties, or a user repeatedly accessing confidential information outside of business hours. The solution is built on a risk-based approach: it does not block everything but surfaces anomalies for investigation.

IRM operates through a pipeline: policy configuration → signal ingestion → indicator scoring → alert generation → case management.

1. Policy Configuration: Administrators create policies in the Microsoft Purview compliance portal (https://compliance.microsoft.com/insiderriskmgmt). Each policy defines: - Triggers: Events that start scoring user activity (e.g., user leaves the organization, user is flagged by Microsoft 365 Defender, user triggers a DLP policy). - Indicators: Specific activities to monitor, such as downloading files, emailing external recipients, or accessing sensitive SharePoint sites. Indicators are organized into categories: Data leaks, Security policy violations, Data theft by departing users, etc. - Thresholds: How many occurrences or what severity triggers an alert. Default thresholds are pre-configured but can be customized.

2. Signal Ingestion: IRM ingests signals from multiple sources: - Exchange Online: Email send/receive events, especially to external domains. - SharePoint Online and OneDrive for Business: File download, upload, share, and delete events. - Teams: Chat messages and file sharing. - Microsoft 365 Defender: Alerts from Defender for Endpoint or Defender for Office 365 (e.g., malware detections). - Azure Active Directory: User attribute changes, account deletions. - Human Resources (HR) connector: Optional connector to import resignation dates, performance warnings, etc.

3. Indicator Scoring: Each indicator has a risk score based on historical baselines. For example, downloading 100 files in an hour from a SharePoint site may score higher than downloading 10 files. The system uses machine learning to establish normal behavior for each user and department. Scores accumulate over a rolling window (default 30 days) for each policy.

4. Alert Generation: When a user's cumulative risk score exceeds a threshold (default: moderate or high), an alert is created in the IRM dashboard. Alerts have severity levels: Low, Medium, High. Administrators can review alerts and decide to escalate to a case.

5. Case Management: A case is a container for investigation. Analysts can:

- Policies: Up to 20 policies can be active simultaneously (default). Each policy can target specific users or groups (e.g., all users, HR department, finance). - Indicators: Over 30 built-in indicators. Examples: - Downloading from SharePoint - Emailing to external recipients - Sharing files with external users - Printing documents - Deleting files - Thresholds: Default alert threshold is 'Medium' (score > 50). Custom thresholds can be set per indicator. - Retention: User activity data is retained for 30 days by default (configurable up to 90 days with additional licensing). - Licensing: Insider Risk Management requires Microsoft 365 E5 Compliance add-on, Microsoft 365 E5, or Microsoft 365 E5 Security. Standalone licensing is not available. - HR Connector: Optional; requires configuration in Microsoft Purview with HR system (e.g., Workday, SAP SuccessFactors).

While most configuration is GUI-based, administrators can use PowerShell with the Exchange Online PowerShell module. Example commands:

# Connect to Exchange Online
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

# Get list of Insider Risk Management policies
Get-InsiderRiskPolicy | Format-Table Name, Status

# Get alerts for a specific policy
Get-InsiderRiskAlert -PolicyId <PolicyId> | Format-Table Id, Severity, CreatedDate

No direct CLI commands exist for every action; the primary interface is the Purview compliance portal.

In short, IRM is a risk-scoring engine that ingests signals from multiple Microsoft 365 workloads, applies machine learning to detect anomalies, and provides a case management interface for investigation. It does not block actions (unlike DLP) but alerts and enables manual or automated remediation.

A large financial services company with 10,000 employees uses Insider Risk Management to detect data theft by departing employees. They configure a policy using the 'Data theft by departing users' template, which triggers when an HR connector imports a resignation date. The policy monitors indicators like downloading files from SharePoint, emailing to personal addresses, and printing confidential documents. In one case, an employee resigned and immediately started downloading hundreds of files from a confidential M&A SharePoint site. The system generated a high-severity alert within hours. The security team investigated via Activity explorer, saw the downloads, and created a case. They contacted the employee's manager, who confirmed the employee had no legitimate reason for the downloads. The team then blocked the employee's access and initiated eDiscovery for legal hold. A common misconfiguration is not enabling the HR connector, which means the policy relies on other triggers (like DLP matches) and may miss departing users who haven't triggered other alerts. Also, thresholds must be tuned to avoid false positives from users who legitimately download large files for work.

A healthcare organization uses a 'Data leaks' policy triggered by DLP policy matches for patient health information (PHI). A nurse accidentally shares a OneDrive folder containing patient records with an external email address. The DLP policy blocks the share and logs the event. Insider Risk Management picks up the DLP match as a trigger and starts monitoring the nurse's activities for 30 days. The nurse has no other risky activities, so the risk score remains low and no alert is generated. However, if the nurse had also emailed files to personal accounts or accessed unusual systems, an alert would fire. The security team reviews the initial DLP incident and determines it was accidental, so they provide training. This scenario shows how IRM works with DLP to detect patterns, not just single events. A pitfall is that DLP policies must be properly configured to detect the sensitive data; otherwise, IRM may not trigger.

A technology company uses a 'Security policy violations' policy that triggers on alerts from Microsoft 365 Defender (e.g., malware detected on a user's device). When a user's device is infected, Defender sends an alert to IRM. IRM then monitors the user for data exfiltration activities that might indicate the malware is stealing data. In one case, a user's device had a keylogger; IRM detected unusual file uploads to a cloud storage service. The combined signals led to a high-severity alert. The security team investigated and confirmed the malware, then isolated the device using Microsoft 365 Defender. This integration shows how IRM broadens the context of security incidents. A common misconfiguration is not enabling the Defender connector, which requires appropriate licensing (E5 Security) and permissions.