Insider Risk Management in Purview: use cases, pseudonymisation and the French framework
Not every data leak comes from outside. An employee leaving for a competitor with a customer file, or carelessly sending sensitive documents to a personal mailbox, remains a common scenario. Insider Risk Management helps detect these situations, provided it sits within a sound social and legal framework.
What Insider Risk Management does
Insider Risk Management correlates signals from Microsoft 365 and, depending on configuration, from endpoints: mass downloads from SharePoint, copies to removable media, printing, sending to external addresses, removing sensitivity labels, uploads to personal cloud storage. It does not read content; it identifies unusual sequences of activity and assigns them a risk score.
The features and the licences required (Microsoft 365 E5, the Compliance add-on or equivalent) change regularly; check the current state in your tenant. Endpoint detection requires devices to be onboarded to Purview.
Use cases that justify the tool
The tool offers policy templates. The ones we most often see delivering value:
- Data theft by departing users: the policy is triggered by a contract end date supplied by an HR connector, or by account deletion, and examines activity in the preceding weeks;
- Data leaks: the policy builds on data loss prevention alerts to spot repeated behaviour rather than isolated incidents;
- Data leaks by priority users: a small group, for example people with access to strategy or research, is subject to lower thresholds.
It is better to start with one or two clearly justified use cases than to enable every template. Each policy produces alerts that someone will have to handle.
Pseudonymisation, an essential setting
By default, user names are pseudonymised in alerts and cases: analysts see an identifier, not a person. This setting limits bias and protects privacy during triage. Pseudonymisation should only be lifted once an alert is judged serious enough, following a defined procedure.
Dedicated roles allow duties to be separated: administrators who configure policies, analysts who triage alerts, investigators who access the activity detail, auditors who review how the tool is used. Avoid a single person holding all of these roles.
Start without monitoring anyone. The analytics feature assesses potential risky activity across the tenant, in aggregated and anonymised form, before any policy is created. It helps size the project and make the case to stakeholders without targeting any individual.
The French framework: works council, GDPR and proportionality
In France, a system that analyses employee activity is not just a technical setting. Several points must be addressed beforehand:
- informing and consulting the works council (CSE) about the introduction of means that allow employee activity to be monitored;
- informing employees individually, for example through the IT acceptable use policy;
- a data protection impact assessment, very likely required for this kind of processing;
- an entry in the record of processing activities, with a defined purpose, legal basis and retention periods;
- proportionality: scope limited to justified data and populations, reasonable thresholds, restricted access to results.
These matters belong to your legal department, your DPO and HR. Our role during an audit is to check that the technical configuration matches what was declared and approved.
Getting started pragmatically
A reasonable roadmap: enable analytics, define a priority use case, complete the social and legal steps, configure one policy with pseudonymisation on, appoint a small group of analysts, then adjust thresholds after a few weeks of observation. Integration with Adaptive Protection, which automatically tightens DLP rules for high-risk users, can come later.
What an audit checks
- Active policies, their templates and their scope.
- The pseudonymisation setting and the procedure for lifting it.
- Members of Insider Risk Management roles and separation of duties.
- Whether alerts and open cases are actually handled.
- HR connectors and triggers in use.
- Consistency with the DPIA, works council information and the IT policy.