Microsoft Purview Insider Risk Management (Baseline)

Insider Risk Management (IRM) uses signals across Microsoft 365 and connected sources to detect, investigate, and act on risky insider activity - data theft, leaks, and policy violations - with privacy-by-design controls (pseudonymisation, RBAC, separation of duties).

When to use

Standing up an insider-risk program: departing-employee data theft, sensitive-data leaks, and security-policy violations - with legal/HR/privacy sponsorship in place.

Do not use this skill for risk-adaptive DLP design after IRM is running (use purview-advanced-dlp) or for general communication compliance (use purview-communication-compliance if available).