Communication compliance

The job

Some risk lives in what people say, not what files move: harassment and bullying, threats and self-harm signals, regulatory violations (a trader promising a return), or sensitive data shared in chat. Communication Compliance supervises communication channels against policies and surfaces matches for human review. It is the sibling of Insider Risk — same privacy philosophy, different signal (content of communications rather than behavioural sequences).

Channels and detection

• Channels: Teams chats and channels, Exchange email, and other supported connectors (including third-party sources via connectors). Copilot interactions increasingly fall in scope as AI-generated content becomes communication too.
• Detection: built-in and custom trainable classifiers (threat, harassment, discrimination, targeted profanity), sensitive information types (data-leak patterns), keyword/lexicon dictionaries, and conditions (direction, domains, attachments). Detection quality inherits the classification foundation — a noisy classifier here floods reviewers exactly as it does in DLP.

The review workflow

Policy matches raise alerts into a review queue. Reviewers triage each — resolve, escalate, tag, notify, or refer to eDiscovery/HR/legal — and every action is recorded. The workflow is the point: Communication Compliance doesn't auto-punish, it routes to a human who decides, with an audit trail.

Privacy and defensibility (the non-negotiable)

Left ungoverned, this is surveillance. The controls that keep it legitimate:

• Pseudonymization / anonymization of usernames in the review experience by default; de-anonymizing is a separate, permissioned action.
• Role separation — reviewers, analysts and admins are distinct role groups; the person configuring policy shouldn't be the one reading identified messages.
• Scoped policies — supervise the populations and risks with a defensible reason, not everyone by default; run past HR/legal/works councils.

The failure mode is a broad, un-scoped policy with de-anonymization on and one person holding every role — technically functional, organisationally toxic, and often legally exposed.

What to watch (proofs)

• Policy scope and detection: the active supervisory policies, their scoped users/channels and the classifiers/SITs they use (Get-SupervisoryReviewPolicyV2, Get-SupervisoryReviewRule) — scoped-and-justified vs blanket.
• The role split: Get-RoleGroupMember for the Communication Compliance reviewer/ analyst/admin groups — separation of duties, proven.
• Alert economics: match volume and reviewer backlog (portal) — a drowning queue means classifiers need tuning, not more reviewers.
• Review auditability: triage/de-anonymization actions in Search-UnifiedAuditLog — the accountability trail that makes the program defensible.