Insider Risk Management - Policy Creation

Insider Risk Management - One of the important wings of Microsoft Purview which help us to setup policy to minimize the insider threat being executed/exposed. Following are simple setup setps to create one such policy.

Micrsoft provider simple template to configure the policy. Go to Microsoft Purview portal >> Click on Insider Rick Management. 

On the left navigation bar, click on Policies. And finally Click on + Create Policy.

Specific to this exsmple, this policy is going to monitor all the interaction is happening with health related data managed and support by a specific team.

You can select all user base, or selective user/group who are e;ligible to work with health related data.

Most of the cases, we select all user base where thispolicy could be applied, however, for quick turn around on daily basis for specific support-team/project-team, you can setup an additional policy here.

Triggering events are events that determine if a user is active in an insider risk management policy. If a user is added to an insider risk management policy that doesn't have a triggering event, the user isn't evaluated by the policy as a potential risk.

TheseiIndicators included in insider risk management policies are used to determine a risk score for an in-scope user.

And, finally you have created the policy.

More to announce...stay tunned :)