Coming soon to general availability, we’re rolling out privacy-enabled security and compliance user activity reports within the Insider Risk Management solution. This feature is currently available in public preview (MC301681).
This message is associated with Microsoft 365 Roadmap ID 88491.
Check before: 2022-10-19
Product: Microsoft 365 suite, Purview, Purview Communication Compliance, Purview compliance portal, Purview Insider Risk Management
Platform: US Instances, Web, World tenant
Status: Launched
Change type: New feature, User impact
Links: 88491
Change Category: minor
Scope: Administration, Compliance, Security, UI, User
Release Phase: General Availability, Preview
Created: 2022-10-05
Updated: 2022-10-05
Public Preview Start Date: 2021-12-01
Task Type: Stay Informed
MS Urgency: normal
MS workload name: Microsoft 365 suite
When this will happen
Rollout will begin in early October and is expected to be complete by late October.
Docu to Check
Automation / Scripts, User Knowledge base, Working instructions for IT Support
How does it affect me
These reports allow Insider Risk Management admins with the appropriate permissions to examine risky user actions that may lead to a potential data security incident, such as an employee attempting to download confidential files to a personal device, for specific users across a defined time period without having to assign them to an Insider Risk Management policy. This helps customers maintain scale and flexibility in cyber risk and data security incident management.
You can get started from the Insider Risk Management overview page by selecting Manage reports in the Investigate user activity section and selecting Create user activity report. New reports typically take up to 10 hours before they’re ready for review. When the report is ready, you’ll see Report ready in the Status column on the User activity report page.
Preperations
Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies to manage security and compliance. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.
Get started with Insider Risk Management in the Microsoft Purview compliance portal:
- Microsoft Purview compliance portal for WW and GCC cloud environments
- Microsoft Purview compliance portal for GCC-High cloud environments
- Microsoft Purview compliance portal for DoD cloud environments
Learn more
- Learn about insider risk management
- Learn about user activity reports