Thank you for continuing to follow the Microsoft Purview blog post series.
Building on Part 9of this series, where I walked through creating a custom Sensitive Information Type (SIT) from scratch, this post explores the purpose and creation of a fingerprint based Sensitive Information Type (SIT).
So, what exactly is a fingerprint SIT?
Unlike traditional SITs that look for patterns like credit card numbers or national insurance details, fingerprint SITs are designed to detect specific, structured documents. Document fingerprinting creates a SIT based on the document’s structure rather than keywords, enabling detection of exact or similar versions of the original document.
Document fingerprinting in Microsoft Purview allows you to take a standard form used within your organisation and create a Sensitive Information Type (SIT) based on its contents. This makes it easier to protect sensitive information by identifying and classifying commonly used documents, such as HR forms, client lists, internal financial reports, employee performance forms, patent templates, government forms or contract templates, that may appear throughout your organisation.
These types of files often contain sensitive information that’s unique to your organisation, and that’s where fingerprinting SITs shine. By uploading a sample document, Microsoft Purview creates a digital “fingerprint” of its contents. This allows you to identify and protect documents that follow a specific template or structure, helping prevent them from being shared outside the organisation. A fingerprint based SIT can then be utilised in Data Loss Prevention (DLP) policies to detect and restrict the sharing of these documents, whether via email, Teams, SharePoint, or OneDrive, ensuring sensitive content stays within trusted boundaries.
Think of this feature like human fingerprints. Just as every person has a unique fingerprint, documents also have unique word patterns and structures. When you upload a file, Microsoft Purview analyses its contents and creates a digital “fingerprint” based on that pattern. This fingerprint can then be used to detect other documents that follow the same structure or contain similar content, making it much easier to identify and protect sensitive files across your organisation.
Document Fingerprinting supports the same file types that are supported in transport rules used within Microsoft Exchange. For a list of supported file types see the image below (Click the image to enlarge).
Note: Microsoft Purview converts the word pattern into a document fingerprint, which is a small Unicode XML file containing a unique hash value that represents the original text. As a security measure, the original document itself isn’t stored in Microsoft 365; only the hash value is stored. The original document can’t be reconstructed from the hash value.
For example, if you set up a Data Loss Prevention (DLP) policy to prevent regular employees from sending emails containing HR onboarding documents, Purview uses the HR Onboarding fingerprint SIT you created to detect and block those messages. However, your HR department may have a legitimate business need to share HR onboarding documents externally. In such cases, you can create exceptions in your DLP (Data Loss Prevention) policy for specific departments, or allow users to override the policy with a business justification which can be audited. More on DLP later in this blog post series.
While document fingerprinting is a powerful feature, it does have some limitations. It won’t detect sensitive information in the following cases:
Password protected files
Image only files
Documents that don’t closely match the original form used to create the fingerprint
Files larger than 4 MB
Now that you have an understanding of how fingerprint Sensitive Information Types (SITs) work and how they’re used in Microsoft Purview, let’s explore how to create a custom fingerprint SIT.
1. Access the Microsoft Purview portal at purview.microsoft.com
2. In the left-hand navigation pane, click Solutions, then select Information Protection.
3. In the left-hand pane, expand Classifiers, then click Sensitive info types.
4. Click + Create Fingerprint based SIT
5. Provide a name and description for your new fingerprint SIT. This helps identify its purpose and usage within your organisation. Click Next
6. Upload the sample document that represents the structured data you want to detect. This document should be a clean, representative version of the form or template you want to fingerprint.
For this demo, I’ll be uploading the following Word document:
This document includes structured fields such as employee details, contact information, onboarding tasks, and policy acknowledgements, making it ideal for fingerprinting in Microsoft Purview.
7. Configure confidence levels or leave the defaults for now
Understanding Confidence Levels When creating a fingerprint Sensitive Information Type (SIT), Microsoft Purview allows you to set confidence levels, these determine how certain the system must be before it considers a match valid.
There are typically three levels:
Low: The system is less strict and may detect loosely matching documents. Useful for broader detection but may result in more false positives.
Medium: A balanced level that requires a reasonable match to the fingerprint. Often used in most scenarios.
High: The system is very strict and only detects documents that closely match the original fingerprint. Ideal for highly sensitive content where accuracy is critical.
Choosing the right confidence level depends on how precise you want the detection to be and the sensitivity of the document you’re protecting. As you evaluate the results, you can adjust the confidence level to better balance accuracy and coverage based on your organisation’s needs.
8. Take a moment to review the name, description, uploaded document, and confidence level settings. Once you’re satisfied, click Create to generate your custom fingerprint Sensitive Information Type (SIT).
Your new SIT will now be available for use in policies such as Data Loss Prevention (DLP) or Information Protection. We will utilise this fingerprint SIT in later blog posts to demonstrate how it can be applied to protect sensitive documents across your organisation.
Thanks for following this blog post series!
Stay tuned for the next post, where I’ll explore trainable classifiers.
In Part 8, we explored how Microsoft Purview uses built-in Sensitive Information Types (SITs) to identify and classify sensitive data. In this part (Part 9), we’ll walk through process of creating a custom Sensitive Information Type from scratch, giving you the flexibility to tailor data classification to your organisation’s unique needs.
So, why would you want to create a custom Sensitive Information Type (SIT)? While Microsoft Purview offers a wide range of built-in SITs to help identify common types of sensitive data, such as credit card numbers, national IDs, and medical information, there may be scenarios where your organisation handles unique or proprietary data that isn’t covered by the default options.
In such cases, creating a custom SIT allows you to define specific patterns, keywords, or validation logic tailored to your business needs, ensuring that even your most niche data types are properly classified and protected. Although you cannot directly edit built-in SITs, you can copy one and then modify the copy to suit your requirements.
In this part, I’ll create a custom SIT designed to detect internal employee ID formats within documents and emails. Since employee ID formats can vary across organisations, a custom SIT allows for tailored detection. For example, one organization might use a format like HRX849201357, which consists of three uppercase letters followed by nine digits.
Let’s begin by exploring how to create a custom SIT for this scenario.
Access the Microsoft Purview portal at purview.microsoft.com
Click Solutions in the left pane, then select Information Protection.
3. In the left pane, expand Classifiers and click Sensitive info types.
4. Click “Create sensitive info type”
5. Enter your custom SIT Details. Provide a name and description for your custom Sensitive Information Type (SIT):
Name: Cloud Build Employee IDs Description: This is a pattern for detecting Cloud Build employee IDs
6. Click Next to proceed
7. Click Create Pattern Sensitive Information Types work by identifying specific patterns in content. Each pattern must include a primary element (shown in the image below), such as a regular expression, keyword list, or built-in function, along with a confidence level that tells Purview how certain it should be when flagging a match. You can also add supporting elements, like keywords, to improve accuracy and reduce false positives.
Let’s explore further.
8. Confidence Level We briefly touched on this topic in the previous post while discussing built-in Sensitive Information Types. Now, let’s take a closer look.
What are confidence levels in Sensitive Info Types (SITs)? Microsoft Purview uses three confidence levels when detecting matches: High, Medium, and Low. These levels indicate how much supporting evidence is found alongside the primary pattern. The more supporting clues, such as nearby keywords or related phrases, a detected item contains, the higher the confidence that it includes the sensitive information you’re trying to identify.
High confidence: The match must strictly follow the defined pattern. A high confidence level means Purview is very certain the item contains sensitive information. This reduces false positives but may miss valid matches, resulting in false negatives.
Medium confidence: The match criteria are moderately strict, balancing accuracy and flexibility.
Low confidence: The match criteria are broad, increasing the chance of detecting relevant items but also raising the risk of false positives.
When testing your custom SIT, you might start with Medium confidence. If detection is too broad, increase it to high. If it’s missing too much, consider lowering to Medium or Low and adding supporting elements to improve accuracy.
We’ll discuss supporting elements shortly.
Primary Element
Moving on, let’s explore the concept of the primary element.
A primary element in Microsoft Purview is the main pattern used to identify sensitive information, such as a credit card number, national ID, employee ID, and others. It forms the core of a Sensitive Information Type (SIT) and is typically defined using a regular expression, keyword, or function.
This element is what Purview looks for first when scanning content. Without a primary element, a SIT cannot function. Supporting elements and confidence levels build around it to improve accuracy and reduce false positives.
When you click Add a Primary Element (as shown in the image below), Microsoft Purview presents you with four options:
Let’s explore each of these options in more detail.
Regular expression:
To detect employee IDs, I’ll use a regular expression. Regular expressions (RegEx) help find patterns in text. Let’s say your organisation uses employee IDs that consist of 3 letters followed by 8 digits (e.g., ABC12345678). The regular expression to detect this format is: [A-Za-z]{3}\d{8}
[A-Za-z]{3} matches exactly 3 letters, uppercase (A-Z) or lowercase (a-z). \d{8} matches exactly 8 digits (numbers from 0 to 9).
The image above displays two options: Word Match and String Match.
Word Match: The rule will only match if the pattern stands alone, separated by spaces or punctuation. For example, "ID:HRX849201357Details" would not match because the ID is embedded within other text and not isolated.
String Match: A match will occur even if the pattern is embedded within other text. For example, the rule would match "ID:HRX849201357Details" because it doesn’t require the ID to be separated.
I have listed a few examples below:
Under the options Word Match and String Match, there is also an option to add validators. These are functions used to perform additional validations on the regular expression pattern. Validators are built-in logic that verify the correctness of a matched pattern. They’re especially useful when your pattern matches something that looks like sensitive data, but you want to confirm it’s valid. For example, the Checksum Validator verifies numbers using algorithms like Luhn, a simple checksum formula used to validate identification numbers, such as credit card numbers. Date Validator ensures matched dates are in a valid format and range.
Keyword list:
A keyword list allows you to define specific words or phrases to look for in content. These could include terms like:
Confidential
Employee ID
Internal use only
Restricted
Staff number and more.
These keywords help to increase the confidence level when detecting sensitive information.
Keyword dictionary:
A keyword dictionary lets you upload a CSV or TXT file containing a large number of custom keywords, such as project names, acronyms, or other organisation specific terms. If you need to manage a large volume of keywords, the dictionary option is the recommended approach, as it allows for easier bulk management and better scalability.
Functions:
Purview includes built-in functions to detect specific types of sensitive data. For example:
func_credit_card – detects credit card numbers using pattern matching and validation.
Other functions exist for detecting things like Social Security Numbers, driver’s license numbers, and more.
9. I have configured my custom SIT as shown in the image below. I have only used a regular expression and have not added any additional elements. Click done.
10. Next, let’s explore character proximity
Character proximity gives you the flexibility to detect both primary and supporting elements within a specified number of characters. Alternatively, you can configure the Sensitive Information Type (SIT) to locate sensitive regardless of proximity, anywhere in the document. Let’s take a closer look.
Understanding Proximity in Sensitive Information Types (SITs)
As we have already learned, a Sensitive Information Type (SIT) is a rule based definition that helps identify specific types of sensitive information, like Social Security Numbers (SSNs), credit card numbers, or health records, within your data estate. However, just finding a number that looks like an SSN (Social Security Number) isn’t enough. To reduce false positives, Purview checks whether that number appears near other supporting elements, such as a name, date of birth, or account number. This is where proximity comes into play.
Proximity defines how close these supporting elements must be to the primary element (e.g., SSN) for a match to be considered valid. For example, if the SIT rule specifies a proximity of 300 characters, then the supporting element must appear within 300 characters before or after the SSN in the document or data file.
Let’s take a closer look at a use case scenario.
Imagine you’re working with a dataset that contains various types of employee information. One of the fields is Employee ID, which is considered sensitive and needs to be protected. To accurately detect this data using Microsoft Purview, you define a Sensitive Information Type (SIT) where Employee ID is the primary element.
However, not every number that looks like an Employee ID should be flagged. To reduce false positives, Purview uses proximity rules. This means the Employee ID must appear within a certain number of characters (e.g., 300 characters) of one or more supporting elements, such as Full Name, Job Title, or Department.
For example, if the SIT is configured with a proximity of 300 characters and supporting elements include Name and Department, then the following would be a valid match:
Employee ID: AZF12345678 Name: Jane Doe Department: Finance
Because the Employee ID appears close to both a name and a department within 300 characters, Purview considers this as a valid detection.
11. Next, let’s explore Supporting Elements
In Microsoft Purview, supporting elements play a crucial role in improving the accuracy of Sensitive Information Type (SIT) detection. While the primary element is the main piece of sensitive data you’re trying to identify, such as an Employee ID, credit card number, or passport number, supporting elements are additional pieces of information that help confirm the context and validity of a match.
For example, if you’re trying to detect an Employee ID, supporting elements might include a person’s name, job title, or department. These elements don’t need to be sensitive themselves, but their presence near the primary element increases the likelihood that the data is meaningful and should be protected. Purview uses these supporting elements in combination with proximity rules (e.g., within 300 characters) to determine whether a match is valid. This helps reduce false positives and ensures that only relevant, sensitive data is flagged.
By configuring supporting elements in your SIT definitions, you can fine-tune detection to match your organisation’s specific data patterns more accurately, making your data protection strategy smarter and more effective.
As shown in the screenshot below, you can add supporting elements such as regular expressions, keyword lists, keyword dictionaries, and functions to enhance your Sensitive Information Type (SIT) definition. You also have the flexibility to group these elements using logical conditions like Any of these, All of these, or Not any of these. This allows you to fine-tune how supporting elements contribute to match detection. Simply click “+ Add supporting elements or group of elements” to begin customising your SIT.
12. Next. let’s explore the option: Additional Checks
In addition, as shown in the second screenshot, you can apply text-based filters to further narrow down what qualifies as a match. These include:
Excluding specific values
Checking whether text starts or ends with certain characters
Including or excluding prefixes or suffixes
Filtering out duplicate characters
To apply these, simply click “+ Add additional checks” and select the conditions that best suit your SIT configuration. These advanced options give you the flexibility to tailor SIT detection to your organisation’s specific data patterns, making your data protection strategy smarter and more effective.
For example: A financial services company uses Microsoft Purview to detect customer account numbers in internal reports. However, during testing, developers often use placeholder values like “1234567890” or “TEST123”. To avoid these being flagged as real data, the team configures a SIT with additional checks to exclude specific values and patterns commonly used in test environments. This ensures only genuine customer data is detected and protected, reducing false positives and improving accuracy.
13. Click Create
14. You can additional patterns to the same SIT if needed. Click Next
15. Clicking Next takes you to the final review screen.
16. Review the details and click Create. This process may take up to one minute to complete.
17. Click Done
18. The newly created custom Sensitive Information Type (SIT) will appear in the list, as shown in the image below.
Detecting Sensitive Data: A Credit Card Example
Let’s take an example to see how primary elements, supporting elements, and character proximity work together. Suppose I want to detect credit card numbers in my data.
To determine whether the message below contains a credit card number, Purview would look for a 16-digit number, known as the primary element. Additionally, if configured in your custom Sensitive Information Type (SIT), the system could also search for supporting elements, such as keywords like credit card or expiry date, within a certain character proximity. This helps confirm the presence of sensitive information.
In the message below, we have the presence of a credit card number, the phrase credit card, and an expiry date, all within close proximity.
If the system detects only the primary element, a credit card number, the confidence level for the match is considered low. However, if the system identifies the primary element along with a supporting element, such as the credit card name or an expiry date, the confidence level is considered high.
I hope you found this post useful.
Join me in Part 10, where I’ll explore how to deploy a fingerprint based Sensitive Information Type (SIT).
Thank you for continuing to follow along with the Microsoft Purview blog post series. If you missed any of the previous posts, you can find them listed below:
Continuing from Part 7, where I provided an overview of Sensitive Information Types (SITs), in this blog post I explore the built-in Sensitive Info Types available in Microsoft Purview. In Part 9, I’ll demonstrate how to create a custom type from scratch.
Access the Microsoft Purview portal at purview.microsoft.com
Click Solutions from the left pane and then click Information Protection
3. From the left pane expand classifiers and click Sensitive info types
4. As explained in the previous post, Microsoft Purview offers a wide range of built-in Sensitive Information Types (SITs) that organisations can use to detect various kinds of sensitive data, such as financial information, personal identifiers, health records, and contact details. (Click the image to enlarge)
5. Explore a few of the built-in Sensitive Information Types (SITs). In this example, I’ve searched for and selected the Credit Card SIT.
6. Click on the Credit Card SIT to open its details.
7. This Credit Card SIT (Sensitive Info Type) displays a few details, which are read-only and cannot be edited.
Click the image below for a visual explanation.
8. As mentioned above, built-in SITs cannot be edited or fully viewed, their internal configuration is locked. To explore how they work, I’ll copy the Credit Card SIT and inspect the cloned version.
Click ‘Copy’ to clone the SIT.
Note: Click once and wait. Cloning may take up to 30 seconds. You’ll receive a notification once the process has completed.
9. Click ‘Yes’ to begin editing the cloned Sensitive Information Type.
10. Click Next
11. The two patterns identified in step 7 earlier should now be clearer.
Pattern 1 includes a primary element, the credit card number, and supporting elements such as CVC number, credit card name, and expiry date. When these elements are detected together, the likelihood of identifying a valid credit card is significantly higher.
Pattern 2 has a low confidence level because it only detects a credit card number on its own.
12. I’ll expand Pattern 1 to explore its configuration, then click the edit icon to view or modify its details. A reminder that this is the cloned SIT I created in step 8 earlier.
13. Click the image below to enlarge it and read the explanations I’ve provided directly on the image.
14. I’ll now edit the keyword lists and the function process to explore these supporting elements. Click the edit button for Keyword list: Keyword_cc_verification
15. Editing the Keyword List: The Keyword_cc_verification entry allows me to view the keyword list created by Microsoft.
16. The Keyword List: Keyword_cc_name contains a predefined list of credit card names.
17. Finally, the Function App can be opened for viewing, but its configuration cannot be modified.
You can’t edit the internal logic of functions like Func_expiration_date and other functions because they’re Microsoft managed components. These functions are locked to preserve accuracy and compliance, so even when you clone a Sensitive Information Type (SIT), the underlying function remains read‑only. What you can do is:
Combine it with other patterns or keywords to refine detection.
Adjust how the function is used in your custom SIT e.g., change confidence levels (low, medium or high), supporting elements, or proximity rules. However, you can’t edit the actual function itself.
18. You can test a Sensitive Information Type (SIT) by uploading a document. For example, upload a Word document containing a list of demo credit card numbers. Then, click Test as shown in the image below.
Note: This procedure only supports unencrypted files. It’s recommended to use two test files, one that contains matching content and one that does not.
The account you use to test sensitive information type performance must be a member of one of the following role groups:
Compliance Administrator
Compliance Data Administrator
Security Administrator
Communication Compliance Admins
Information Protection Admins
Information Protection Investigators
Organization Management
19. Click Upload file
20. I have a sample Word document containing demo data, including credit card numbers, as shown below.
Here is the result after uploading the document to the test tool and clicking the Test button: all possible matches have been identified, including those with high confidence
The same credit card numbers appear under low, medium, and high confidence levels because the test tool evaluates each confidence level independently. When a match satisfies all criteria, pattern match, Luhn validation, and supporting evidence, it is listed under each category to show how broadly it qualifies.
Thank you for following along with this blog post series.
Join me in Part 9 where I’ll show you how to create a Sensitive Information Type (SIT) from scratch.
Thank you for continuing to follow along with the Microsoft Purview blog post series. If you missed any of the previous posts, you can find them listed below:
In this blog post, I’m introducing Sensitive Information Types (SITs), which are part of the Information Protection solution available under the Solutions menu in the Microsoft Purview portal: https://purview.microsoft.com
To keep this series beginner-friendly and easy to digest, each post focuses on one concept at a time.
In the next post, Part 8, I’ll walk through the process of deploying a Sensitive Information Type (SIT) within the Purview portal.
Within Information Protection, there are several menu items to explore.
To start, I’ll focus on Classifiers > Sensitive Info Types, as this is a key area for identifying and managing sensitive data across your organisation.
What are Sensitive info types (SIT)?
Identifying and classifying sensitive items within your organisation is the first step in the Information Protection process.
Microsoft Purview offers three primary methods for identifying sensitive data which we will explore in this blog post series:
Manually, by users
via automated pattern recognition, as with Sensitive Information Types (SITs)
via machine learning
Also known as SITs for short, Sensitive information types are pattern based classifiers. They detect sensitive information within your organisation, such as social security, credit card, bank account numbers and more to identify sensitive items. Microsoft provides a large number of built-in SITs. A complete list of Sensitive Information Types is available in the official Microsoft documentation at the following Microsoft link, Sensitive information type entity definitions, and these are also accessible directly from the Purview portal.
Here are a few examples of Sensitive Information Type (SIT) entity definitions from Microsoft’s list:
– Bulgaria passport number – Croatia passport number – Credit card number – Finland national ID – France passport number – Spain driver’s license number – U.K. national insurance number (NINO) – U.K. driver’s license number – U.K. Unique Taxpayer Reference Number – U.A.E. identity card number – And more
If the preconfigured/built-in sensitive information types (SITs) don’t meet your organisation’s needs, you can create custom SITs that you fully define, or you copy and modify one of the built-in types to suit your requirements.
So, what’s the benefit of using Sensitive Information Types (SITs)? SITs are foundational to many Microsoft Purview solutions. One key example is their use in Data Loss Prevention (DLP) policies, where SITs can be added to detect and prevent the sharing of sensitive data, such as credit card numbers via email, Teams, or other communication channels. (More on DLP in a future post.)
Beyond DLP, SITs are used across several Microsoft Purview features, including:
Data Loss Prevention policies
Sensitivity labels
Retention labels
Insider risk management
Communication compliance
Auto-labeling policies
Microsoft Priva
This versatility makes SITs a powerful tool for enforcing data protection and compliance across your organisation.
Example – use case
Imagine your organisation handles customer transactions and stores credit card information as part of its operations. You want to ensure that this sensitive data is not accidentally or intentionally shared via email, Teams, or other communication channels.
To address this, you can use Microsoft Purview to:
Deploy a Sensitive Information Type (SIT) Microsoft already provides a built-in SIT for credit card numbers, which uses pattern recognition to detect sequences that match known credit card formats. You can use this built-in SIT or create a custom SIT to match your organisation’s specific data patterns.
Create a Data Loss Prevention (DLP) Policy In the Microsoft Purview portal, you can create a DLP policy that includes/attaches the credit card SIT. This policy can be configured to:
Monitor emails and messages for credit card numbers.
Alert users when they attempt to send sensitive data.
Block the transmission entirely, depending on the severity and policy settings.
Apart from the built-in Sensitive Information Types (SITs) provided by Microsoft, there are other types, such as custom SITs and Exact Data Match (EDM) SITs, which I’ll be covering later in this blog post series.
I hope you now have a basic understanding of Sensitive Information Types (SITs) and the important role they play in Microsoft Purview’s Information Protection capabilities.
Thank you for following along with this blog post series.
Join me in Part 8 where I explore built-in sensitive info types (SITS)
In this blog post, I’ll walk you through step by step instructions on how to enable Microsoft Purview Insider Risk Analytics and configure data sharing to help your organisation proactively manage insider threats.
What is Microsoft Purview Insider Risk
Before diving into the steps to enable analytics and data sharing, it’s important to first provide a brief overview of Microsoft Purview Insider Risk. I’ll be exploring Microsoft Purview Insider Risk in more detail later in this blog series.
Organisations are facing growing challenges not only from external threats but increasingly from within the organisation. Microsoft Purview Insider Risk Management is a powerful solution designed to help organisations detect, investigate, and mitigate insider risks, whether those actions are accidental or intentional.
Microsoft Purview Insider Risk Management correlates various signals to identify insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies to manage security and compliance. Built with privacy by design, users are pseudonymized (where user identities are hidden or replaced with fake names) by default.
Why It Matters:
According to Microsoft’s Data Security Index 2024, insider threats are a major concern:
63% of all data breaches originate from insider activity.
93% of organisations report being concerned about insider risks.
These statistics show why it’s so important for organisation’s to take a proactive approach to insider risk management. Microsoft Purview Insider Risk Management can play a key role in helping to detect and respond to these risks early.
Common Use Cases:
Microsoft Purview Insider Risk Management helps organisations spot and respond to risky activities before they become serious issues. Here are some everyday examples:
Employees leaving the company: A staff member downloads sensitive files or sends them to personal email just before resigning.
Disgruntled or upset employees: Someone unhappy with their role starts accessing confidential data and uploading large amounts of data to personal cloud storage.
Data theft: An employee tries to copy files to a USB drive without permission.
Cross-team investigations: HR, legal, and security teams can work together to understand and respond to suspicious behaviour.
I’ll go into more detail about Microsoft Purview Insider Risk later in this blog series, but first, let’s look at how to enable Insider Risk analytics and data sharing.
This is a crucial first step as it enables organisations to conduct an evaluation of potential insider risks in your organisation without configuring any insider risk policies. Once enabled, analytics can highlight risky user activity, generate severity scores, and share insights with tools like Data Loss Prevention (DLP), Communication Compliance, and Microsoft Defender (More on these features later in the series). These insights help build a strong foundation for managing insider risks effectively.
Access purview.microsoft.com
Click solutions from the left pane and then Insider Risk Management
3. Click Data sharing from the left pane
4. Turn on share user risk details with other security solutions and click save
When turned on, admins with the correct permissions will be able to review user risk details from Insider Risk Management within other solutions such as Data Loss Prevention (DLP), Communication Compliance, and Microsoft Defender. The data shared is based on user activities detected by Insider Risk Management policies and user-level analytics. I’ll enable user-level analytics in the next step, as it’s a required configuration for sharing user risk details with other security solutions.
Export alert details to SIEM services: I will leave this option off. This option allows the export of alert details to third party SIEM solutions.
5. Click analytics from the left pane and turn on both settings to get a complete coverage of insights across the tenant and from different security solutions.
– Show insights at tenant level When enabled, this setting aggregates data across the organisation and displays it in analytics reports. It doesn’t provide detailed user-level insights or integrate with other security tools like DLP (Data Loss Prevention) or Microsoft Defender. Microsoft recently introduced user-level insights to address this gap.
Note: User-level insights cannot be enabled on their own, tenant-level insights must be turned on first. Disabling tenant-level insights will also disable user-level insights.
Show insights at user level This works with the data sharing option I enabled in the previous step. User-level analytics provide insights for all eligible users in your organisation, including those not covered by any Insider Risk Management policy. When investigating alerts in Microsoft Defender, DLP, or Communication Compliance, analysts with the right permissions automatically gain access to user-level data, helping improve risk assessments. I’ll explore Insider Risk policies later in this blog series.
A close-up of the options is shown below. To gain the most complete insights, I’ll be enabling both tenant-level and user-level analytics.
Note: Tenant-level analytics must be turned on before enabling user-level analytics. If tenant-level analytics is disabled, user-level analytics will also be turned off.
Additionally, data sharing must be enabled alongside user-level analytics. I enabled data sharing in the previous step.
6. Enable both and click save
Note: To enable insider risk user-level analytics, you must be a member of the Insider Risk Management, Insider Risk Management Admins, or Microsoft 365 Global admin role group.
That’s it for this part of the blog series. I’ll explore Insider Risk policies in more detail later in the series.
In the next post, I’ll begin exploring Information Protection in Microsoft Purview, starting with Sensitive Information Types (SITs), a key component for identifying and classifying sensitive data.
