Implement and manage Microsoft Purview Insider Risk Management

Microsoft via Microsoft Learn

Go to class Write review

Understand Microsoft Purview Insider Risk Management.
After completing this module, you'll be able to:
- Define insider risks and their effect on organizations.
- Understand the purpose of Microsoft Purview Insider Risk Management.
- Identify key features like policies, signals, analytics, dashboards, and investigative tools.
- Recognize how these tools detect and address potential risks.
- Explore scenarios that demonstrate effective risk management strategies.
Prepare for Microsoft Purview Insider Risk Management.
After completing this module, you'll be able to:
- Collaborate with stakeholders to prepare for insider risk management.
- Understand what's needed to meet prerequisites for implementation.
- Configure settings to align with compliance and privacy needs.
- Explore how connecting tools and data sources enhances risk management.
Create and manage Insider Risk Management policies.
After completing this module, you'll be able to:
- Explain the purpose of policy templates.
- Identify when to use quick or custom policies.
- Create quick policies for common scenarios.
- Build and configure custom policies for specific risks.
- Update and manage policies as organizational needs change.
Investigate Insider Risk Alerts and Related Activity.
After completing this module, you'll be able to:
- Understand how alerts are generated and prioritized in Insider Risk Management.
- Tune policies and thresholds to manage alert volume effectively.
- Use the Alerts dashboard and alert details to triage and respond to risky activity.
- Investigate behavior using tabs like All risk factors, Activity explorer, and User activity.
- Integrate with Microsoft Defender XDR for broader threat investigation.
- Create, manage, and resolve Insider Risk Management cases.
Understand how Adaptive Protection applies machine learning to assess user risk and automatically enforce the right level of security controls. By dynamically assigning Data loss prevention, Data lifecycle management, and Conditional Access policies, it strengthens data security while reducing unnecessary alerts and manual intervention.
Upon completion of this module, you should be able to:
- Describe Adaptive Protection and its role in dynamically mitigating risks.
- Configure risk level settings and customize risk levels based on your organization's needs.
- Set up Adaptive Protection with quick or custom setup.
- Manage Adaptive Protection to review policy metrics, track in-scope users, and assess risk levels.

Syllabus

Understand Microsoft Purview Insider Risk Management
- Introduction
- What is an insider risk?
- Microsoft Purview Insider Risk Management overview
- Microsoft Purview Insider Risk Management features
- Case study: Protect sensitive data with Insider Risk Management
- Module assessment
- Summary
Prepare for Microsoft Purview Insider Risk Management
- Introduction
- Plan for Insider Risk Management
- Prepare your organization for Insider Risk Management
- Configure settings for Insider Risk Management
- Integrate Insider Risk Management with data sources and tools
- Module assessment
- Summary
Create and manage Insider Risk Management policies
- Introduction
- Understand Insider Risk Management policy templates
- Compare quick and custom insider risk policies
- Create a custom Insider Risk Management policy
- Manage policies in Insider Risk Management
- Module assessment
- Summary
Investigate insider risk alerts and related activity
- Introduction
- Understand insider risk alerts and investigations
- Manage alert volume in insider risk management
- Investigate and triage insider risk alerts in Microsoft Purview
- Investigate insider risk alerts with Security Copilot and AI agents
- Analyze alert context with the All risk factors tab
- Investigate activity details with the Activity explorer tab
- Review patterns over time with the User activity tab
- Investigate insider risk alerts in Microsoft Defender XDR
- Manage and take action on insider risk cases
- Exercise - Investigate potential data theft using Insider Risk Management
- Module assessment
- Summary
Implement Adaptive Protection in Insider Risk Management
- Introduction
- Adaptive Protection overview
- Understand and configure risk levels in Adaptive Protection
- Configure Adaptive Protection
- Manage Adaptive Protection
- Summary and knowledge check