Topic 5 of 6
Insider risk and communication compliance
Not every threat comes from outside. An employee leaving with the customer list, another sharing a file carelessly, a harassing message in a chat. Purview has specific solutions for these risks, designed to balance protecting the company with people's privacy.
Contents
What is insider risk?
It's the risk created by people with legitimate access: employees, contractors, or partners. They're already inside, so firewalls and antivirus don't stop them.
Accidental
Sharing a file with the wrong person, uploading customer data to a personal service without thinking.
Malicious
Intellectual property theft, fraud, sabotage, insider trading.
Insider Risk Management
It helps you detect, investigate, and act on risky internal activities: data leaks, confidentiality violations, intellectual property theft, fraud, insider trading, and regulatory violations. It's built on four principles:
Transparency
Privacy by design, balanced against organizational risk
Configurable
Policies based on industry, geography, and business groups
Integrated
A common workflow with other Purview solutions
Actionable
Notifications, data reviews, and user investigations
Privacy
Usernames are pseudonymized by default: analysts see the activity without knowing whose it is until needed. Access is also role-based, so only authorized people investigate.
Before you create policies, insider risk analytics assesses the organization's activity and shows where the most risk is, with no prior setup.
Scenarios it covers
Policies are created from scenario templates:
Data theft by departing users
Mass downloads or emails to personal accounts near the departure date, known through an HR connector.
Data leaks
Inappropriate sharing, accidental or intentional, of sensitive information.
Security policy violations
Disabling security or installing unauthorized apps, with Defender for Endpoint signals.
Risky AI usage
Prompt injection or sending sensitive data to uncontrolled AI services.
Priority users
Executives or admins with sensitive access, under stricter monitoring.
Risky behavior and work stressors
Poor reviews or demotions, known through HR connectors.
Patient data misuse
Improper access to medical records in healthcare organizations (in preview).
Forensic evidence
Visual captures of device activity for investigations, with approval.
How a policy works
| Piece | What it is | Example |
|---|---|---|
| Users | Who it applies to | The whole sales department |
| Triggering event | What starts the scoring of a user's activity | Resignation date recorded in HR |
| Indicators | Activities that are monitored | Downloading from SharePoint, copying to USB, sending to personal email |
| Risk score | Combines indicators, frequency, and context | Downloading 500 confidential files scores higher than 5 |
Workflow
Policies
Predefined templates and conditions: indicators, users, services, and monitoring period.
Alerts
Generated when activity matches the policy conditions.
Triage
Alerts awaiting review are turned into a case, assigned to an existing one, or dismissed. An AI triage agent helps prioritize them.
Investigate
Cases with the user's activity, Content explorer, case notes, and a data risk graph (with Sentinel).
Action
Send the user a policy reminder, resolve the case, or escalate it to eDiscovery (Premium) for legal review.
Adaptive protection
Applying the strictest controls to everyone slows work down; applying them to nobody leaves gaps. Adaptive protection uses machine learning and insider risk levels to apply dynamic controls from three solutions: DLP, Data Lifecycle Management, and Entra Conditional Access. Controls tighten or relax automatically as each user's risk changes.
| Level | DLP example | Conditional Access example |
|---|---|---|
| Minor | Educational policy tip | Accept terms of use |
| Moderate | Warning with justification | Block highly sensitive apps |
| Elevated | Block saving or sharing externally | Block all apps |
In Data Lifecycle Management, whatever an elevated-risk user deletes from SharePoint, OneDrive, or Exchange is kept for 120 days, to stop them from destroying evidence.
Communication Compliance
An insider risk solution that detects, captures, and acts on inappropriate messages, in text and images, in Teams, Viva Engage, Outlook, WhatsApp, and Microsoft 365 Copilot prompts and responses.
Corporate policies
Offensive language, harassment, threats, or discrimination.
Risk management
Unauthorized communications about confidential projects, such as a merger.
Regulatory compliance
Supervising brokers for insider trading, money laundering, or bribery.
Configure: Choose which communications, from whom, and what conditions (classifiers, keywords).
Investigate: Review flagged messages, with history and context.
Remediate: Resolve, tag, notify the user, escalate, or remove the message from Teams.
Maintain: Tune policies over time based on results.
Role-based access control separates IT admins from compliance reviewers, and names can also be pseudonymized.
Information barriers
Information barriers stop certain groups from communicating or collaborating with each other in Teams, SharePoint, and OneDrive. They're used when there's a conflict of interest or a regulatory requirement: for example, separating investment bankers from the analysts who publish recommendations.
They're in the Risk & Compliance area of the Purview portal. They don't analyze message content: they simply block communication between the defined segments.
Which solution to choose?
| Insider Risk | Communication Compliance | Information barriers | |
|---|---|---|---|
| Looks at | Activities (download, copy, share) | Message content | Who can talk to whom |
| Example | Exfiltration before leaving the company | Harassment in Teams | Separating two departments |
| Type | Detect and investigate | Detect and remediate | Prevent |
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| Detect whether a departing employee downloads lots of files | Insider Risk Management (departing users) | It uses the departure date as the triggering event. |
| Detect someone disabling antivirus and installing hacking tools | Insider Risk (security policy violations) | It uses Defender for Endpoint signals. |
| Detect harassment or offensive language in Teams chats | Communication Compliance | It analyzes message content. |
| Review whether brokers share insider information | Communication Compliance (regulatory) | Supervision of regulated communications. |
| Have DLP controls tighten automatically for elevated-risk users | Adaptive protection | It adjusts controls by risk level. |
| Stop two departments from communicating in Teams | Information barriers | It separates groups because of a conflict of interest. |
| Know where the most risk is before creating policies | Insider risk analytics | It assesses with no prior setup. |
| Hand an insider risk case over to the legal department | Escalate to eDiscovery (Premium) | It preserves and reviews the evidence. |
Common exam traps
❓ You want to detect harassment in Teams messages. Insider Risk or Communication Compliance?
Communication Compliance: it analyzes communication content. Insider Risk focuses on activities like exfiltration.
❓ Do Insider Risk analysts see usernames from the start?
No. Names are pseudonymized by default.
❓ Which three solutions does adaptive protection use?
DLP, Data Lifecycle Management, and Microsoft Entra Conditional Access.
❓ How long does Data Lifecycle Management keep what an elevated-risk user deletes?
120 days.
❓ Do information barriers analyze message content?
No. They only block communication between defined segments.
❓ Does Communication Compliance only monitor email?
No. It also covers Teams, Viva Engage, WhatsApp, and Microsoft 365 Copilot interactions.
❓ An Insider Risk case needs legal review. Where is it escalated?
To eDiscovery (Premium).
Did you get this topic?
Test what you just learned
An employee has resigned, and the company wants to detect whether they download large volumes of files or send them to their personal email before leaving. Which solution does it use?
Ready to test "Insider risk and communication compliance"?
Original questions, each with a full explanation.
Start a mock exam