Insider Risk Management

Insider Risk Management (IRM) is a Microsoft Purview solution that uses machine learning and behavioral analytics to identify, triage, and remediate insider risks. It is designed to address three primary scenarios: data theft by departing employees, accidental data leaks (e.g., oversharing sensitive files), and security policy violations (e.g., accessing unauthorized resources). IRM is not a DLP solution—it focuses on user behavior patterns rather than content inspection, though it integrates with DLP policies to enrich alerts.

IRM operates through a pipeline of: data ingestion → baseline establishment → indicator scoring → policy evaluation → alert generation → case management. Here's the detailed step-by-step:

1. Data Ingestion: IRM ingests signals from various Microsoft 365 sources: - Audit Logs: Office 365 audit logs (e.g., file downloads, SharePoint access, email sends). - Microsoft 365 Defender: Alert signals from Defender for Endpoint (e.g., malware detection, suspicious process execution). - Microsoft Entra ID: Identity signals (e.g., failed sign-ins, risky sign-ins from Entra ID Protection). - HR Connector: Optional integration with HR systems (e.g., Workday, SAP SuccessFactors) to ingest employee status changes (resignation, termination) and performance data. - Physical Badging: Optional integration with physical access systems (e.g., badge-in/out logs).

All signals are stored in the Microsoft 365 Compliance Center's unified audit log.

Deviations from this baseline are scored as anomalies.

Risk scores range from 0 to 100. Scores above a configurable threshold (default 75) generate an alert.

4. Policy Evaluation: An insider risk policy defines the conditions that trigger an alert. Policies consist of: - Triggers: Events that start evaluating a user (e.g., "User is terminated", "User downloads >50 files in 1 hour"). - Indicators: Specific behaviors to monitor (e.g., "Email attachment sent to external domain"). - Thresholds: Customizable values (e.g., "Download >100 files in 24 hours"). - Actions: What happens when a threshold is exceeded (e.g., "Generate alert", "Notify compliance officer").

Policies can be scoped to specific users (via user groups) or all users. Out-of-the-box templates include: - Data theft by departing users - Data leaks - Security policy violations - Offensive language

6. Case Management: A case is a container for investigation. It includes: - Activity Explorer: A timeline of user actions with detailed audit log entries. - User Activity Reports: Summaries of risk-related actions. - Forensic Evidence: (Requires add-on) Recorded screen captures of user activity. - Remediation Actions: Options to send a notification, escalate to eDiscovery, or trigger a DLP policy.

Cases can be assigned to investigators, and notes can be added. The case can be closed as Resolved, Dismissed, or Escalated.

While IRM is primarily GUI-based, some configurations use PowerShell:

# Enable audit logging
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

# Get insider risk policies
Get-InsiderRiskPolicy

# Create a custom indicator via compliance center (no direct cmdlet)

Insider Risk Management is deployed in enterprises to detect data exfiltration by departing employees. For example, a large financial institution uses IRM with the HR connector integrated with Workday. When an employee submits a resignation, IRM automatically starts monitoring that user for 30 days. The policy triggers if the user downloads more than 50 files from SharePoint within 24 hours. In one case, a departing employee downloaded 200 files containing customer PII. IRM generated an alert, the case was escalated to eDiscovery, and legal placed a hold on the employee's account. The company prevented a data breach.

Another common scenario is accidental data leaks. A healthcare organization uses IRM to monitor for users who send large attachments to external domains. The policy triggers if a user sends more than 5 emails with attachments >10 MB to external recipients in one hour. This caught a nurse who accidentally emailed patient records to the wrong address. The analyst sent an alert to the nurse and initiated a DLP policy to block future occurrences.

Misconfiguration can lead to false positives or missed threats. For instance, if the threshold for 'Download from SharePoint' is set too low (e.g., 10 files), it generates alerts for normal work activities, overwhelming analysts. Conversely, if the threshold is too high (e.g., 500 files), actual data theft may go undetected. Also, if the HR connector is not configured, IRM cannot detect departing users, leaving the organization blind to data theft by resigning employees. Performance-wise, IRM scales well up to 50,000 users; beyond that, consider using custom indicators to reduce noise.