Skip to content

Control 1.12: Insider Risk Detection and Response

Control ID: 1.12
Pillar: Security
Regulatory Reference: FINRA Rule 3110 (Supervision), FINRA Rule 4511 (Books and Records), FINRA Notice 21-18 (Cybersecurity), FINRA RN 24-09, SEC Rule 17a-3/17a-4 (Recordkeeping), SEC Regulation S-P (2024 amendments — 30-day customer notice; 72-hour service-provider notice), NYDFS 23 NYCRR §500.06 / §500.16 / §500.17, GLBA 501(b) (Safeguards Rule), SOX Sections 302/404 (Internal Controls), OCC Bulletin 2026-13 (formerly OCC Bulletin 2011-12) / Federal Reserve SR 26-2 (formerly SR 11-7) (Model Risk), FFIEC IT Examination Handbook (Information Security; Management)
Last UI Verified: May 2026
Last Verified: 2026-10-18 (technical documentation; no live UI verification)
Governance Levels: Baseline / Recommended / Regulated

Objective

Detect potentially malicious or inadvertent insider activities that could harm the organization, including risky data movement, abusive prompts, suspicious agent interactions, and security-policy violations. Microsoft Purview Insider Risk Management is primarily a detection, triage, and investigation capability — it is not a standalone blocking control, a books-and-records retention plane, an HR investigation workflow, or a substitute for supervisory review by a registered principal. Use it as one layer of defense-in-depth alongside DLP, Communication Compliance, Audit (Premium), Conditional Access, eDiscovery (Premium), incident response, and the firm's documented Written Supervisory Procedures.

Non-Substitution

Insider Risk Management does not replace HR investigations, employee-relations processes, legal-hold / eDiscovery decisions, supervisory review under the firm's Written Supervisory Procedures (FINRA Rule 3110), formal incident response and regulator-notification workflows (Control 3.4), books-and-records retention (Control 1.7, Control 1.9), or model-risk governance for AI-driven scoring (Control 2.6).

Why This Matters for FSI

Regulation How this control supports it
GLBA 501(b) Helps detect insider activity that could expose customer NPI; Adaptive Protection (where available) raises DLP / DLM /...
SOX 404 Supports internal-control monitoring of insider activity touching financial reporting data and supervisory systems
SEC 17a-4 / 17a-3 / FINRA 4511 Insider Risk Management is a detection and investigation surface, not a books-and-records retention plane.
FINRA 3110 / RN 24-09 Helps support supervisory expectations over insider activity, including AI-agent activity; FINRA RN 24-09 expects supervision of...
OCC Bulletin 2026-13 (formerly OCC 2011-12) / Fed SR 26-2 (formerly SR 11-7) ML-powered risk scoring and the AI Triage Agent are model-driven; firms should bring them into their model inventory, validation,...
NYDFS 23 NYCRR 500 §500.17(a) IRM detections may surface determinations that trigger the 72-hour cybersecurity-event clock; cross-link to FSI Incident Handling...
Regulatory mapping — click to expand
  • GLBA 501(b): Helps detect insider activity that could expose customer NPI; Adaptive Protection (where available) raises DLP / DLM / Conditional Access posture as a user's risk level changes
  • SOX 404: Supports internal-control monitoring of insider activity touching financial reporting data and supervisory systems
  • SEC 17a-4 / 17a-3 / FINRA 4511: Insider Risk Management is a detection and investigation surface, not a books-and-records retention plane. IRM cases, alerts, and Forensic Evidence clips are working investigative artifacts (Forensic Evidence clips auto-delete 120 days after capture unless exported). Durable, tamper-resistant retention is provided by retention policies, retention labels, and records management — see Control 1.9
  • FINRA 3110 / RN 24-09: Helps support supervisory expectations over insider activity, including AI-agent activity; FINRA RN 24-09 expects supervision of AI/agent behavior at parity with employees — IRM contributes detection signal, Communication Compliance (Control 1.10) and DLP/DSPM (Control 1.5 / Control 1.6) provide complementary coverage
  • OCC Bulletin 2026-13 (formerly OCC 2011-12) / Fed SR 26-2 (formerly SR 11-7): ML-powered risk scoring and the AI Triage Agent are model-driven; firms should bring them into their model inventory, validation, and ongoing-monitoring program — see Control 2.6
  • NYDFS 23 NYCRR 500 §500.17(a): IRM detections may surface determinations that trigger the 72-hour cybersecurity-event clock; cross-link to FSI Incident Handling in the troubleshooting playbook

No companion solution for this control — see the Solutions Index for the full companion-solution catalog and coverage scope.

Control Description

Capability Description
Data theft detection Detect unauthorized data extraction by users leaving your organization (Microsoft 365 and non-Microsoft 365 apps)
Data leak monitoring Identify external sharing, email exfiltration, USB copy
Security violations Import Microsoft Defender for Endpoint alerts for security-policy violations; Entra sign-in risk is separate context
Agent abuse detection Identify misuse of agent capabilities and configurations
ML-powered analytics AI-driven risk pattern detection and scoring

Risky Agents Policy Template

Microsoft Purview Insider Risk Management includes a Risky Agents (preview) policy for Microsoft Copilot Studio, Microsoft Foundry, and agents built using the P4AI SDK. The dedicated agent-monitoring documentation describes a default policy for organizations with supported licenses after service setup. It helps detect risky prompts, sensitive agent responses, sensitive-data access, and risky websites. Administrative units are not supported for agent alerts; scoped analysts cannot see them. Guest interactions do not expose full prompt/response content. Do not treat default availability as proof of telemetry or blanket coverage for every agent architecture.

Risky AI Usage Policy Template

The Risky AI usage template detects risky prompts and responses across Microsoft 365 Copilot, Microsoft Copilot, and other AI surfaces. This template requires a browser signal source on the user's device (see Browser Signal Prerequisites below) and feeds Adaptive Protection scoring.

Forensic Evidence (Opt-In, Dual-Authorization, Capacity Add-On)

Forensic Evidence is an opt-in capability that captures customizable visual activity for high-risk users. It is off by default. Per Microsoft Learn (insider-risk-management-forensic-evidence):

  • Requires a separate Forensic Evidence policy in addition to the in-scope detection policy
  • Uses a dual-authorization model — unrestricted Insider Risk Management Admins submit capture requests for specific users, independent Insider Risk Management Approvers approve them, and Investigators view captures. The broad Insider Risk Management group also has request, approval, and viewing permissions, so role names alone do not establish two-person separation; preserve the firm's separation-of-duties requirements (see Microsoft's permissions matrix)
  • Requires devices onboarded to Microsoft Purview, Windows 10 / 11 Enterprise, and the Microsoft Purview Client
  • Requires the forensic evidence capacity add-on: 100 GB/month ingestion units; unused capacity does not carry forward. A conditional 20 GB trial is available only on the legacy commerce platform. Do not substitute general IRM indicator PAYG billing for this capacity entitlement
  • Captured clips are deleted 120 days after capture unless downloaded or transferred before deletion. Do not treat forensic evidence as your compliant books-and-records retention mechanism. If a clip becomes evidentiary, export and preserve it under the firm's retention, legal-hold, and supervisory-evidence process (see Control 1.7, Control 1.9, and eDiscovery (Premium))
  • The overview also warns of earlier deletion at preview end; management guidance has conflicting capture/ingestion and post-expiry export wording. Plan required exports before the earliest applicable boundary and seek clarification rather than relying on post-expiry recovery
  • State-law notice requirements (e.g., Connecticut, Delaware, New York employee monitoring laws) may apply; coordinate with Privacy / Legal before enabling

Browser Signal Prerequisites

Risky AI usage, Risky browser usage, and several browser-derived indicators require a browser signal source. Per Microsoft Learn (insider-risk-management-browser-support):

  • Microsoft Edge — use the Microsoft Compliance Extension for extension-dependent activities; some file activities have native browser support
  • Google Chrome — install the Microsoft Compliance Extension
  • Windows-only; non-Windows devices are not supported
  • Devices must be onboarded to Microsoft Purview
  • The relevant browsing indicators must be enabled in Settings → Policy indicators → Browsing indicators

Adaptive Protection

Adaptive Protection uses calculated insider risk levels (Minor / Moderate / Elevated) with supported DLP locations, Data Lifecycle Management (preview), and Conditional Access (preview). Quick setup creates DLP policies in test mode and Conditional Access policies in report-only, not immediate blocking. The DLM 120-day preservation is separate from forensic clip retention. Verify supported user/agent behavior for each consumer rather than assuming enforcement parity. See Adaptive Protection.

Triage Agent

The Triage Agent is a Security Copilot–powered agent that helps prioritize alerts. The Insider Risk Management (IRM) Triage Agent reached general availability at Microsoft Ignite 2025. Production use requires Security Copilot SCU (Security Compute Unit) capacity allocated to the Purview workspace; the agent summary tab sub-feature remains in Preview as of May 2026. See Copilot in Purview: IRM Triage Agent get-started and Security Copilot Agents in Purview overview.

Other AI / Detection Surfaces

  • Data risk graphs — visualize relationships between users, agents, data sources, and signals during investigation
  • Content preview — investigators can preview related files from SharePoint, Exchange, OneDrive directly during alert triage; verify current lifecycle on Learn

Key Configuration Points

Licensing and PAYG (verify on Learn at deployment):

  • IRM core requires Microsoft 365 E5, E5 Compliance, Insider Risk Management standalone, or Microsoft Purview Suite (per-user)
  • Specific indicators and Triage Agent require pay-as-you-go (PAYG) billing; forensic evidence uses the separate capacity add-on described above

Tenant-level prerequisites:

  • Unified Audit Log on — IRM policies and analytics scans use UAL. The independent Insider risk audit log remains enabled separately and retains administrator actions for 180 days; export it for longer preservation
  • Insider Risk Management role groups configured per the table in Roles & Responsibilities (six groups, including Approvers for Forensic Evidence dual-auth)
  • Pseudonymization — usernames are pseudonymized in IRM by default; preserve this default unless your privacy framework requires otherwise, and audit any re-identification
  • Administrative units — for FSI subsidiaries, broker-dealer / RIA / bank LOB segregation, and regional review teams, scope IRM admin/analyst/investigator membership using administrative units where supported on Learn

Connector and integration prerequisites:

  • Microsoft 365 HR connector (CSV upload + scheduled ingestion) — required for HR-triggered departing-/risky-user scenarios. Employee resignation data maps UPN (UserPrincipalName), ResignationDate, and LastWorkingDate using ISO 8601 date-time values (EmployeeID is not a required mapped resignation field; other HR scenarios have separate schemas). Template-specific alternatives include Entra account deletion for departing users and Communication Compliance for risky users. Review connector upload logs and RecordsSaved per Microsoft's HR connector guide
  • Microsoft Defender for Endpoint integration — required for Security policy violations and the priority-/departing-/risky-users variants (security control evasion, unwanted software, MDE alerts). Without MDE the policy template will not produce signal
  • Microsoft Defender for Cloud Apps connectors (Box, Dropbox, Google Drive, Amazon S3, Azure) — required for cloud-app coverage in Data theft by departing users; the template itself is single — the cloud-app indicators come from the connectors
  • Physical badging connector (optional) — supports physical-access correlation for high-security floors / trading floors
  • DLP for High-severity incident reports — required when DLP is the trigger source for Data leaks

IRM DLP workload limitations

The High Severity DLP Alert indicator only evaluates alerts written to the Microsoft 365 audit log by supported workloads. The following DLP workloads are not currently routed to Insider Risk Management — alerts generated by DLP policies scoped exclusively to these workloads will not appear in IRM alerts, cases, or activity views:

Unsupported workload What is NOT forwarded to IRM
Microsoft Teams DLP policy matches in Teams chat and channel messages
Endpoint DLP DLP policy matches on Windows and macOS devices
Microsoft 365 Copilot DLP policy matches in Copilot interactions
Power BI DLP policy matches in Power BI datasets
On-premises repositories DLP policy matches on on-premises file shares and SharePoint Server

This is by design — only DLP alerts from Exchange Online, SharePoint Online, and OneDrive for Business are currently evaluated by IRM. Where IRM-equivalent visibility is required for these unsupported workloads, use the corresponding workload-specific monitoring:

If your DLP policy spans multiple workloads and at least one of the supported workloads (Exchange Online, SharePoint Online, OneDrive) is in scope, IRM will evaluate only the alerts from the supported workloads. Alerts from the unsupported workloads in the same policy will still not appear in IRM.

Policy templates to consider for FSI (use Learn-canonical names verbatim):

  • Data theft by departing users (single template; cloud-app coverage via Defender for Cloud Apps)
  • Data leaks
  • Data leaks by priority users (MNPI, trading desk, RIA staff)
  • Data leaks by risky users (PIP / Communication-Compliance-flagged)
  • General security policy violations (and priority-/departing-/risky-users variants)
  • Risky AI usage (requires browser extension)
  • Risky browser usage (preview — verify lifecycle on Learn; requires browser extension)
  • Forensic evidence (separate paired policy with dual-auth opt-in)
  • Risky Agents — applied by default; not selected via Create policy
  • Patient data misuse — out of scope unless healthcare; document exclusion

Operational:

  • Enable analytics (de-identified scans; Learn states scans may take up to 48 hours to complete)
  • Define priority user groups (agent admins, trading desk, client-facing) and the role groups permitted to view each priority user group
  • Define an alert triage workflow with documented severity, owner, and escalation per the firm's WSP — Microsoft does not publish IRM investigation SLAs
  • Configure case escalation path to eDiscovery (Premium) for legal hold

Zone-Specific Requirements

Zone cross-reference

Baseline = Zone 1 (Personal Productivity) · Recommended = Zone 2 (Team Collaboration) · Regulated = Zone 3 (Enterprise Managed). Zone requirements below correspond to the Governance Level in the control header.

Zone Requirement Rationale
Zone 1 (Personal) Data leaks policy with high-severity alerts; review under firm-defined supervisory cadence (WSP) Limited scope and risk
Zone 2 (Team) Data leaks + General security policy violations + Risky AI usage; HR connector configured for in-scope populations; firm-defined SLA documented in WSP Shared data and AI usage increase risk
Zone 3 (Enterprise) All applicable templates including Data theft by departing users, Data leaks by priority/risky users, Risky AI usage, Risky Agents (default), Adaptive Protection, Forensic Evidence (where licensing + cloud parity permit); priority user groups for trading / RIA / client-facing; eDiscovery (Premium) escalation defined; firm-defined SLA documented in WSP Maximum protection and supervisory coverage

Microsoft Learn does not publish IRM investigation or alert-response SLAs. Where this framework or your WSP cites response targets, those are firm-defined supervisory commitments, not Microsoft-stated ceilings. Document them in your WSP and align with FINRA 3110 supervisory expectations.

Roles & Responsibilities

Insider Risk Management defines six role groups in Microsoft Purview (per Learn insider-risk-management-permissions). Use canonical role names verbatim (role catalog). Role-group membership changes propagate within approximately 30 minutes.

Role group Responsibility FSI separation-of-duties note
Insider Risk Management (catch-all) Full IRM access — configure policies, investigate alerts and cases, request/approve/view forensic captures, and view/export the IRM audit log Avoid in regulated FSI tenants; prefer the segmented groups below
Insider Risk Management Admins Configure IRM policies, settings, role groups, priority user groups, priority content; submit forensic capture requests (unrestricted members) Separate requesters from Approvers; use authorized role-management permissions for membership changes
Insider Risk Management Analysts Triage and review alerts; cannot view file/email content Tier-1 supervisory analyst
Insider Risk Management Investigators Investigate cases, view content and forensic captures (subject to permissions and pseudonymization); cannot submit forensic capture requests with this assignment alone Tier-2 investigator; review activity through the IRM solution audit log
Insider Risk Management Auditors View/export the independent IRM administrator audit log; reconcile privacy actions with firm evidence Independent assurance / Internal Audit; must not also be Admin or Investigator
Insider Risk Management Approvers Required to approve Forensic Evidence capture requests (dual-authorization) Must be distinct from Investigators; assign to a separate Compliance / Privacy approver
Microsoft 365 HR connector owner (Microsoft Entra app + connector role) Maintain HR connector ingestion, CSV schema, scheduled job health Coordinate with HRIS team
Microsoft Defender for Endpoint admin Maintain MDE integration required for Security policy violations templates Security operations
Privacy Officer / Legal Approve Forensic Evidence enablement, state-law notice posture, pseudonymization re-identification policy Required gate before Forensic Evidence opt-in
Control Relationship
1.5 - DLP and Sensitivity Labels DLP signals for insider risk
1.7 - Audit Logging Audit data for detection
1.10 - Communication Compliance Communication signals
1.8 - Runtime Protection Threat detection correlation
1.6 - Grounding Data Protection / DSPM for AI DSPM for AI signals feed Risky AI usage
1.9 - Records Retention and Immutability Durable retention plane for IRM artifacts (IRM is not the records store)
2.6 - Model Risk Management ML risk scoring + Triage Agent require MRM governance
2.12 - Supervision and Oversight FINRA Rule 3110 / RN 24-09 AI agent supervision

Implementation Playbooks

Step-by-Step Implementation

This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

Verification Criteria

Confirm control effectiveness by verifying:

  1. License entitlement (E5 / E5 Compliance / Purview Suite) and any required PAYG billing confirmed
  2. Unified Audit Log enabled in the tenant
  3. All six IRM role groups assigned per separation-of-duties model; Approvers distinct from Investigators
  4. Pseudonymization default-on confirmed; re-identification audit trail tested
  5. Microsoft 365 HR connector ingesting on schedule; required fields populated
  6. Microsoft Defender for Endpoint integration configured (for Security policy violations templates)
  7. Microsoft Defender for Cloud Apps connectors configured (for departing-user cloud-app coverage)
  8. Browser extension (Edge / Chrome) deployed via Intune to in-scope Windows devices; browsing indicators enabled
  9. All in-scope FSI policy templates created with Learn-canonical names, scope (priority groups, AUs), and exclusions
  10. Analytics scan completed (allow up to 48h)
  11. Seed activity by a named test user generates an alert in the dashboard within the documented window
  12. Investigation workflow creates a case, assigns to Investigator, and (where in scope) escalates to eDiscovery (Premium)
  13. Adaptive Protection (where available) enabled with thresholds and consumer DLP / DLM / Conditional Access policies bound; verify with a threshold-trigger test
  14. Forensic Evidence (where opted in): unrestricted Admin requester and independent Approver verified; capacity add-on/usage captured; required exports completed before capture-based 120-day deletion or earlier applicable preview end; destination preservation verified separately
  15. Risky Agents default policy producing signal in Standard / Triage Agent dashboard
  16. IRM administrative activity is reviewed and exported from the independent Insider Risk Management audit log, which retains activity for 180 days; Microsoft 365 audit prerequisite evidence and SIEM alert delivery are verified separately
  17. FSI Incident Handling cross-referenced from the troubleshooting playbook

Additional Resources

Technical verification: 2026-10-18 — audit-system boundary, HR schema, browser extension name, and forensic request permissions checked against live Microsoft Learn. Tenant UI and other feature lifecycles were not exercised.

Updated: October 2026 | Version: v1.6.2 | UI Verification Status: Needs Review (targeted technical verification; tenant UI not exercised)