Insider risk management

The problem it addresses

DLP asks "is this content sensitive and leaving?" Insider Risk asks the human question behind it: "is this person's pattern of behaviour risky?" It correlates signals over time rather than judging a single action — the departing employee who suddenly downloads the customer list looks very different from the same download by a stable, long-tenured user.

Signals, indicators, policies

• Signals come from across the estate: file downloads/exfiltration, DLP matches, Defender alerts, Entra risky sign-ins, physical-access/HR connector events, and browsing to consumer AI or personal storage.
• Indicators are the signals you switch on for scoring (e.g. "downloading content from SharePoint", "copying to USB", "emailing to personal account").
• Policy templates shape which risks you watch: data theft by departing users (paired with the HR connector for resignation/termination dates), data leaks, risky browser usage, security policy violations.
• Sequences matter more than single events — collect-then-exfiltrate (download, then upload to personal cloud) scores higher than either alone.

Privacy by design (the model that keeps it legitimate)

Insider Risk is built to not be surveillance:

• Pseudonymization — usernames are masked by default in the experience; seeing real identities is a separately-permissioned step.
• Role separation — Analysts triage pseudonymized alerts; Investigators (a distinct role group) work identified cases; Admins configure. Collapsing these into one person is the governance failure that turns the tool toxic.
• Scoping and consent — deployments typically run past HR/legal/works-council review; the tooling enforces least exposure so the program stays defensible.

The workflow

Policy scores users → alerts raise on threshold breaches → analysts triage → confirmed concerns escalate to cases → cases gather evidence (activity timeline, related DLP/eDiscovery) → outcome (dismiss, remediate, escalate to eDiscovery/legal). Activity Explorer underpins the evidence view.

The PowerShell reality (failure mode)

Insider Risk is largely portal- and Graph-driven; its Security & Compliance PowerShell surface is minimal, and much of it is not app-only — a service principal cannot stand in for a licensed Investigator. Export-ActivityExplorerData is the practical cmdlet for pulling the underlying activity signal. Any automation claiming Insider Risk coverage must be honest that the alert/case surface is interactive-only.

What to watch (proofs)

• Policy shape: which templates and indicators are active, and whether the HR connector is feeding departure dates (Purview Insider Risk settings) — a data-theft policy without HR dates is half-blind.
• The role split: Get-RoleGroupMember for the Insider Risk Analyst vs Investigator vs Admin groups — proof the separation-of-duties model holds.
• Signal flow: Export-ActivityExplorerData for the activity underpinning alerts — the evidence layer, and the app-only-reachable slice.
• Alert-to-case throughput: alert volume, dismissal rate and case escalation trend (portal) — a program that's tuned vs one drowning in noise.