# Control 1.12: Insider Risk Detection and Response

**Control ID:** 1.12<br>
**Pillar:** Security<br>
**Regulatory Reference:** FINRA Rule 3110 (Supervision), FINRA Rule 4511 (Books and Records), FINRA Notice 21-18 (Cybersecurity), FINRA RN 24-09, SEC Rule 17a-3/17a-4 (Recordkeeping), SEC Regulation S-P (2024 amendments — 30-day customer notice; 72-hour service-provider notice), NYDFS 23 NYCRR §500.06 / §500.16 / §500.17, GLBA 501(b) (Safeguards Rule), SOX Sections 302/404 (Internal Controls), OCC Bulletin 2026-13 (formerly OCC Bulletin 2011-12) / Federal Reserve SR 26-2 (formerly SR 11-7) (Model Risk), FFIEC IT Examination Handbook (Information Security; Management)<br>
**Last UI Verified:** April 2026<br>
**Governance Levels:** Baseline / Recommended / Regulated<br>

---

## Objective

Detect potentially malicious or inadvertent insider activities that could harm the organization, including risky data movement, abusive prompts, suspicious agent interactions, and security-policy violations. Microsoft Purview Insider Risk Management is primarily a **detection, triage, and investigation** capability — it is **not** a standalone blocking control, a books-and-records retention plane, an HR investigation workflow, or a substitute for supervisory review by a registered principal. Use it as one layer of defense-in-depth alongside DLP, Communication Compliance, Audit (Premium), Conditional Access, eDiscovery (Premium), incident response, and the firm's documented Written Supervisory Procedures.

!!! warning "Non-Substitution"
    Insider Risk Management does **not** replace HR investigations, employee-relations processes, legal-hold / eDiscovery decisions, supervisory review under the firm's Written Supervisory Procedures (FINRA Rule 3110), formal incident response and regulator-notification workflows ([Control 3.4](../pillar-3-reporting/3.4-incident-reporting-and-root-cause-analysis.md)), books-and-records retention ([Control 1.7](1.7-comprehensive-audit-logging-and-compliance.md), [Control 1.9](1.9-data-retention-and-deletion-policies.md)), or model-risk governance for AI-driven scoring ([Control 2.6](../pillar-2-management/2.6-model-risk-management-sr-26-2.md)).

!!! warning "Sovereign Cloud Availability — GCC, GCC High, DoD"
    Microsoft Learn explicitly states that **Adaptive Protection is not available for US Government cloud programs at this time**. Risky Agents (preview), Risky AI usage (which depends on a browser signal source on Windows), Forensic Evidence, and the Triage Agent (which depends on Microsoft Security Copilot + SCUs) require feature-by-feature parity verification before being claimed as in-scope for sovereign tenants. For tenants where a feature is not available, document the compensating controls — DLP ([Control 1.5](1.5-data-loss-prevention-dlp-and-sensitivity-labels.md)), Communication Compliance ([Control 1.10](1.10-communication-compliance-monitoring.md)), Audit (Premium) ([Control 1.7](1.7-comprehensive-audit-logging-and-compliance.md)), Defender for Cloud Apps, Sentinel UEBA ([Control 3.9](../pillar-3-reporting/3.9-microsoft-sentinel-integration.md)), manual supervisory review, and an exception register — and re-verify quarterly.

---

## Why This Matters for FSI

- **GLBA 501(b):** Helps detect insider activity that could expose customer NPI; Adaptive Protection (where available) raises DLP / DLM / Conditional Access posture as a user's risk level changes
- **SOX 404:** Supports internal-control monitoring of insider activity touching financial reporting data and supervisory systems
- **SEC 17a-4 / 17a-3 / FINRA 4511:** Insider Risk Management is a **detection and investigation surface**, not a books-and-records retention plane. IRM cases, alerts, and Forensic Evidence clips are working investigative artifacts (Forensic Evidence clips auto-delete 120 days after capture unless exported). Durable, tamper-resistant retention is provided by retention policies, retention labels, and records management — see [Control 1.9](1.9-data-retention-and-deletion-policies.md)
- **FINRA 3110 / RN 24-09:** Helps support supervisory expectations over insider activity, including AI-agent activity; FINRA RN 24-09 expects supervision of AI/agent behavior at parity with employees — IRM contributes detection signal, Communication Compliance ([Control 1.10](1.10-communication-compliance-monitoring.md)) and DLP/DSPM ([Control 1.5](1.5-data-loss-prevention-dlp-and-sensitivity-labels.md) / [Control 1.6](1.6-microsoft-purview-dspm-for-ai.md)) provide complementary coverage
- **OCC Bulletin 2026-13 (formerly OCC 2011-12) / Fed SR 26-2 (formerly SR 11-7):** ML-powered risk scoring and the AI Triage Agent are model-driven; firms should bring them into their model inventory, validation, and ongoing-monitoring program — see [Control 2.6](../pillar-2-management/2.6-model-risk-management-sr-26-2.md)
- **NYDFS 23 NYCRR 500 §500.17(a):** IRM detections may surface determinations that trigger the 72-hour cybersecurity-event clock; cross-link to FSI Incident Handling in the troubleshooting playbook

---

!!! info "No companion solution by design"
    Not all controls have a companion solution in [FSI-AgentGov-Solutions](https://github.com/judeper/FSI-AgentGov-Solutions); solution mapping is selective by design. This control is operated via native Microsoft admin surfaces and verified by the framework's assessment-engine collectors. See the [Solutions Index](../../reference/solutions-index.md#coverage-scope) for the catalog and coverage scope.


## Control Description

| Capability | Description |
|------------|-------------|
| Data theft detection | Detect unauthorized data extraction by users leaving your organization (Microsoft 365 and non-Microsoft 365 apps) |
| Data leak monitoring | Identify external sharing, email exfiltration, USB copy |
| Security violations | Monitor failed access attempts and risky sign-ins |
| Agent abuse detection | Identify misuse of agent capabilities and configurations |
| ML-powered analytics | AI-driven risk pattern detection and scoring |

### Risky Agents Policy Template

Microsoft Purview Insider Risk Management includes a **Risky Agents (preview)** template targeting agents hosted on **Microsoft Copilot Studio** and **Microsoft Foundry**. Per Microsoft Learn this template is **applied by default** for organizations using Insider Risk Management — it is not added through the **Create policy** wizard. It helps detect risky prompts, sensitive agent responses, access to sensitive or priority SharePoint content, risky website access, external sharing, and activity above the agent's normal baseline. **Do not treat this as blanket coverage for all agent types or as full runtime inspection of every Microsoft 365 Copilot interaction.** Verify preview / GA status and tenant availability on Microsoft Learn at deployment time.

### Risky AI Usage Policy Template

The **Risky AI usage** template detects risky prompts and responses across Microsoft 365 Copilot, Microsoft Copilot, and other AI surfaces. **This template requires a browser signal source on the user's device** (see *Browser Signal Prerequisites* below) and feeds Adaptive Protection scoring.

### Forensic Evidence (Opt-In, Dual-Authorization, PAYG)

**Forensic Evidence** is an opt-in capability that captures customizable visual activity for high-risk users. It is **off by default**. Per Microsoft Learn (`insider-risk-management-forensic-evidence`):

- Requires a separate **Forensic Evidence** policy in addition to the in-scope detection policy
- Uses a **dual-authorization** model — capture requests are submitted by an Insider Risk Management Investigator and approved by a member of the **Insider Risk Management Approvers** role group (which **must be distinct** from Investigators)
- Requires devices onboarded to Microsoft Purview, Windows 10 / 11 Enterprise, and the **Microsoft Purview Client**
- Billed via **pay-as-you-go (PAYG)** with an organizational storage trial (verify current trial size on Learn at deployment time)
- **Captured clips are deleted 120 days after capture** unless downloaded or transferred before deletion. **Do not treat forensic evidence as your compliant books-and-records retention mechanism.** If a clip becomes evidentiary, export and preserve it under the firm's retention, legal-hold, and supervisory-evidence process (see [Control 1.7](1.7-comprehensive-audit-logging-and-compliance.md), [Control 1.9](1.9-data-retention-and-deletion-policies.md), and eDiscovery (Premium))
- State-law notice requirements (e.g., Connecticut, Delaware, New York employee monitoring laws) may apply; coordinate with Privacy / Legal before enabling

### Browser Signal Prerequisites

Risky AI usage, Risky browser usage, and several browser-derived indicators require a browser signal source. Per Microsoft Learn (`insider-risk-management-browser-support`):

- **Microsoft Edge** — install the **Microsoft Insider risk extension** (or use the Microsoft Purview extension where indicated by Learn for the specific scenario)
- **Google Chrome** — install the **Microsoft Purview extension**
- **Windows-only**; non-Windows devices are not supported
- Devices must be onboarded to Microsoft Purview
- The relevant browsing indicators must be enabled in **Settings → Policy indicators → Browsing indicators**

### Adaptive Protection

**Adaptive Protection** dynamically assigns DLP, Data Lifecycle Management (120-day retention preservation for elevated-risk users), and Conditional Access controls based on calculated insider risk level (Minor / Moderate / Elevated). Adaptive Protection consumes signals from IRM policies including Risky AI usage and Risky Agents.

### Triage Agent

The **Triage Agent** is a Security Copilot–powered agent that helps prioritize alerts. The Insider Risk Management (IRM) Triage Agent reached general availability at Microsoft Ignite 2025. Production use **requires Security Copilot SCU (Security Compute Unit) capacity** allocated to the Purview workspace; the `agent summary tab` sub-feature remains in Preview as of May 2026. See [Copilot in Purview: IRM Triage Agent get-started](https://learn.microsoft.com/en-us/purview/copilot-in-purview-triage-irm-agent-get-started) and [Security Copilot Agents in Purview overview](https://learn.microsoft.com/en-us/purview/copilot-in-purview-agents-overview).

### Other AI / Detection Surfaces

- **Data risk graphs** — visualize relationships between users, agents, data sources, and signals during investigation
- **Content preview** — investigators can preview related files from SharePoint, Exchange, OneDrive directly during alert triage; verify current lifecycle on Learn

### Sovereign Cloud Availability

> **Important — FSI sovereign cloud caveat:** Per Microsoft Learn, Insider Risk Management — and in particular **Adaptive Protection** — has limited availability in **US Government cloud programs (GCC, GCC High, DoD)**. Confirm current availability of each IRM capability (core IRM policies, Risky AI usage, Risky Agents, Risky browser usage, Forensic Evidence, Adaptive Protection, Triage Agent) for your tenant cloud before relying on this control. For tenants where IRM or Adaptive Protection is unavailable, document the gap as a control exception and apply compensating controls (Communication Compliance, Audit Premium, DLP, Defender for Cloud Apps, Sentinel UEBA).

---

## Key Configuration Points

**Licensing and PAYG (verify on Learn at deployment):**

- IRM core requires Microsoft 365 E5, E5 Compliance, Insider Risk Management standalone, or Microsoft Purview Suite (per-user)
- Specific indicators / capabilities (notably Forensic Evidence) require **pay-as-you-go (PAYG)** billing on a linked Azure subscription
- **Sovereign cloud:** confirm current availability per the *Sovereign Cloud Availability* note above

**Tenant-level prerequisites:**

- **Unified Audit Log on** — IRM policies and analytics scans use UAL; without it, policies produce no signal (this is the most common silent-failure mode)
- Insider Risk Management role groups configured per the table in *Roles & Responsibilities* (six groups, including Approvers for Forensic Evidence dual-auth)
- **Pseudonymization** — usernames are pseudonymized in IRM by default; preserve this default unless your privacy framework requires otherwise, and audit any re-identification
- **Administrative units** — for FSI subsidiaries, broker-dealer / RIA / bank LOB segregation, and regional review teams, scope IRM admin/analyst/investigator membership using administrative units where supported on Learn

**Connector and integration prerequisites:**

- **Microsoft 365 HR connector** (CSV upload + scheduled ingestion) — required for *Data theft by departing users*, *Data leaks by risky users (priority-user PIP signal)*, and termination-driven scoping. Map `EmployeeID`, `ResignationDate`, `LastWorkingDate` minimum
- **Microsoft Defender for Endpoint integration** — required for *Security policy violations* and the priority-/departing-/risky-users variants (security control evasion, unwanted software, MDE alerts). Without MDE the policy template will not produce signal
- **Microsoft Defender for Cloud Apps connectors** (Box, Dropbox, Google Drive, Amazon S3, Azure) — required for cloud-app coverage in *Data theft by departing users*; the template itself is single — the cloud-app indicators come from the connectors
- **Physical badging connector** (optional) — supports physical-access correlation for high-security floors / trading floors
- **DLP for High-severity incident reports** — required when DLP is the trigger source for *Data leaks*

!!! warning "IRM DLP workload limitations"
    The **High Severity DLP Alert** indicator only evaluates alerts written to the Microsoft 365 audit log by supported workloads. The following DLP workloads are **not** currently routed to Insider Risk Management — alerts generated by DLP policies scoped exclusively to these workloads will not appear in IRM alerts, cases, or activity views:

    | Unsupported workload | What is NOT forwarded to IRM |
    |---|---|
    | **Microsoft Teams** | DLP policy matches in Teams chat and channel messages |
    | **Endpoint DLP** | DLP policy matches on Windows and macOS devices |
    | **Microsoft 365 Copilot** | DLP policy matches in Copilot interactions |
    | **Power BI** | DLP policy matches in Power BI datasets |
    | **On-premises repositories** | DLP policy matches on on-premises file shares and SharePoint Server |

    This is by design — only DLP alerts from Exchange Online, SharePoint Online, and OneDrive for Business are currently evaluated by IRM. Where IRM-equivalent visibility is required for these unsupported workloads, use the corresponding workload-specific monitoring:

    - **Teams DLP** and **Endpoint DLP** — [Control 1.5 — DLP and Sensitivity Labels](1.5-data-loss-prevention-dlp-and-sensitivity-labels.md) for policy configuration and alert triage
    - **Microsoft 365 Copilot** interactions — [Control 1.6 — DSPM for AI](1.6-microsoft-purview-dspm-for-ai.md) and [Control 1.10 — Communication Compliance](1.10-communication-compliance-monitoring.md)
    - **Endpoint DLP** device-level signals — [Control 1.5](1.5-data-loss-prevention-dlp-and-sensitivity-labels.md); Sensitive Information Types used in those policies — [Control 1.13](1.13-sensitive-information-types-sits-and-pattern-recognition.md)
    - **Power BI** — Power BI admin monitoring and Microsoft Purview Data Map integration (out of scope of this control; document gap in exception register)

    If your DLP policy spans multiple workloads and at least one of the supported workloads (Exchange Online, SharePoint Online, OneDrive) is in scope, IRM will evaluate only the alerts from the supported workloads. Alerts from the unsupported workloads in the same policy will still not appear in IRM.

**Policy templates to consider for FSI (use Learn-canonical names verbatim):**

- *Data theft by departing users* (single template; cloud-app coverage via Defender for Cloud Apps)
- *Data leaks*
- *Data leaks by priority users* (MNPI, trading desk, RIA staff)
- *Data leaks by risky users* (PIP / Communication-Compliance-flagged)
- *General security policy violations* (and priority-/departing-/risky-users variants)
- *Risky AI usage* (requires browser extension)
- *Risky browser usage* (preview — verify lifecycle on Learn; requires browser extension)
- *Forensic evidence* (separate paired policy with dual-auth opt-in)
- *Risky Agents* — applied by default; not selected via Create policy
- *Patient data misuse* — out of scope unless healthcare; document exclusion

**Operational:**

- Enable analytics (de-identified scans; Learn states scans may take up to **48 hours** to complete)
- Define priority user groups (agent admins, trading desk, client-facing) and the role groups permitted to view each priority user group
- Define an alert triage workflow with documented severity, owner, and escalation per the firm's WSP — Microsoft does not publish IRM investigation SLAs
- Configure case escalation path to eDiscovery (Premium) for legal hold

---

## Zone-Specific Requirements

| Zone | Requirement | Rationale |
|------|-------------|-----------|
| **Zone 1** (Personal) | Data leaks policy with high-severity alerts; review under firm-defined supervisory cadence (WSP) | Limited scope and risk |
| **Zone 2** (Team) | Data leaks + General security policy violations + Risky AI usage; HR connector configured for in-scope populations; firm-defined SLA documented in WSP | Shared data and AI usage increase risk |
| **Zone 3** (Enterprise) | All applicable templates including Data theft by departing users, Data leaks by priority/risky users, Risky AI usage, Risky Agents (default), Adaptive Protection, Forensic Evidence (where licensing + cloud parity permit); priority user groups for trading / RIA / client-facing; eDiscovery (Premium) escalation defined; firm-defined SLA documented in WSP | Maximum protection and supervisory coverage |

> Microsoft Learn does not publish IRM investigation or alert-response SLAs. Where this framework or your WSP cites response targets, those are firm-defined supervisory commitments, not Microsoft-stated ceilings. Document them in your WSP and align with FINRA 3110 supervisory expectations.

---

## Roles & Responsibilities

Insider Risk Management defines six role groups in Microsoft Purview (per Learn `insider-risk-management-permissions`). Use canonical role names verbatim ([role catalog](../../reference/role-catalog.md)). Role-group membership changes propagate within approximately 30 minutes.

| Role group | Responsibility | FSI separation-of-duties note |
|------------|----------------|-------------------------------|
| **Insider Risk Management** (catch-all) | Full IRM access — configure policies, investigate alerts and cases, view forensic captures (where Approver also assigned), export | Avoid in regulated FSI tenants; prefer the segmented groups below |
| **Insider Risk Management Admins** | Configure IRM policies, settings, role groups, priority user groups, priority content | Assign to Compliance / IRM admin function |
| **Insider Risk Management Analysts** | Triage and review alerts; cannot view file/email content | Tier-1 supervisory analyst |
| **Insider Risk Management Investigators** | Investigate cases, view content (subject to pseudonymization), submit Forensic Evidence capture requests | Tier-2 investigator; logs all unmask actions |
| **Insider Risk Management Auditors** | View IRM audit logs (admin actions, settings changes, unmask events) | Independent assurance / Internal Audit; **must not** also be Admin or Investigator |
| **Insider Risk Management Approvers** | **Required** to approve Forensic Evidence capture requests (dual-authorization) | **Must be distinct** from Investigators; assign to a separate Compliance / Privacy approver |
| Microsoft 365 HR connector owner (Microsoft Entra app + connector role) | Maintain HR connector ingestion, CSV schema, scheduled job health | Coordinate with HRIS team |
| Microsoft Defender for Endpoint admin | Maintain MDE integration required for Security policy violations templates | Security operations |
| Privacy Officer / Legal | Approve Forensic Evidence enablement, state-law notice posture, pseudonymization re-identification policy | Required gate before Forensic Evidence opt-in |

---

## Related Controls

| Control | Relationship |
|---------|--------------|
| [1.5 - DLP and Sensitivity Labels](1.5-data-loss-prevention-dlp-and-sensitivity-labels.md) | DLP signals for insider risk |
| [1.7 - Audit Logging](1.7-comprehensive-audit-logging-and-compliance.md) | Audit data for detection |
| [1.10 - Communication Compliance](1.10-communication-compliance-monitoring.md) | Communication signals |
| [1.8 - Runtime Protection](1.8-runtime-protection-and-external-threat-detection.md) | Threat detection correlation |
| [1.6 - Grounding Data Protection / DSPM for AI](1.6-microsoft-purview-dspm-for-ai.md) | DSPM for AI signals feed Risky AI usage |
| [1.9 - Records Retention and Immutability](1.9-data-retention-and-deletion-policies.md) | Durable retention plane for IRM artifacts (IRM is not the records store) |
| [2.6 - Model Risk Management](../pillar-2-management/2.6-model-risk-management-sr-26-2.md) | ML risk scoring + Triage Agent require MRM governance |
| [2.12 - Supervision and Oversight](../pillar-2-management/2.12-supervision-and-oversight-finra-rule-3110.md) | FINRA Rule 3110 / RN 24-09 AI agent supervision |

---

## Implementation Playbooks

!!! info "Step-by-Step Implementation"

    This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

    - [Portal Walkthrough](../../playbooks/control-implementations/1.12/portal-walkthrough.md) — Step-by-step portal configuration
    - [PowerShell Setup](../../playbooks/control-implementations/1.12/powershell-setup.md) — Automation scripts
    - [Verification & Testing](../../playbooks/control-implementations/1.12/verification-testing.md) — Test cases and evidence collection
    - [Troubleshooting](../../playbooks/control-implementations/1.12/troubleshooting.md) — Common issues and resolutions

---

## Verification Criteria

Confirm control effectiveness by verifying:

1. License entitlement (E5 / E5 Compliance / Purview Suite) and any required PAYG billing confirmed; sovereign cloud availability documented (or exception logged)
2. Unified Audit Log enabled in the tenant
3. All six IRM role groups assigned per separation-of-duties model; Approvers distinct from Investigators
4. Pseudonymization default-on confirmed; re-identification audit trail tested
5. Microsoft 365 HR connector ingesting on schedule; required fields populated
6. Microsoft Defender for Endpoint integration configured (for Security policy violations templates)
7. Microsoft Defender for Cloud Apps connectors configured (for departing-user cloud-app coverage)
8. Browser extension (Edge / Chrome) deployed via Intune to in-scope Windows devices; browsing indicators enabled
9. All in-scope FSI policy templates created with Learn-canonical names, scope (priority groups, AUs), and exclusions
10. Analytics scan completed (allow up to 48h)
11. Seed activity by a named test user generates an alert in the dashboard within the documented window
12. Investigation workflow creates a case, assigns to Investigator, and (where in scope) escalates to eDiscovery (Premium)
13. Adaptive Protection (where available) enabled with thresholds and consumer DLP / DLM / Conditional Access policies bound; verify with a threshold-trigger test
14. Forensic Evidence (where opted in): dual-auth approver list captured; PAYG storage healthy; clip retention 120-day handoff to eDiscovery / records retention exercised
15. Risky Agents default policy producing signal in Standard / Triage Agent dashboard
16. IRM admin actions are emitted to the unified audit log under the InsiderRiskManagement* operations and reviewed on cadence
17. FSI Incident Handling cross-referenced from the troubleshooting playbook

---

## Additional Resources

- [Microsoft Learn: Insider Risk Management Overview](https://learn.microsoft.com/en-us/purview/insider-risk-management)
- [Microsoft Learn: Configure Insider Risk Management](https://learn.microsoft.com/en-us/purview/insider-risk-management-configure)
- [Microsoft Learn: Insider Risk Management Permissions](https://learn.microsoft.com/en-us/purview/insider-risk-management-permissions)
- [Microsoft Learn: Adaptive Protection](https://learn.microsoft.com/en-us/purview/insider-risk-management-adaptive-protection)
- [Microsoft Learn: Forensic Evidence](https://learn.microsoft.com/en-us/purview/insider-risk-management-forensic-evidence)
- [Microsoft Learn: Browser Signal Detection](https://learn.microsoft.com/en-us/purview/insider-risk-management-browser-support)
- [Microsoft Learn: Policy Templates](https://learn.microsoft.com/en-us/purview/insider-risk-management-policy-templates)
- [Microsoft Learn: Create Insider Risk Policies](https://learn.microsoft.com/en-us/purview/insider-risk-management-policies)
- [Microsoft Learn: Policy Indicators](https://learn.microsoft.com/en-us/purview/insider-risk-management-settings-policy-indicators)
- [Microsoft Learn: Insider Risk Activities](https://learn.microsoft.com/en-us/purview/insider-risk-management-activities)
- [Microsoft Learn: Insider Risk Cases](https://learn.microsoft.com/en-us/purview/insider-risk-management-cases)
- [Microsoft Learn: HR Data Connector](https://learn.microsoft.com/en-us/purview/import-hr-data)
- [Microsoft Graph Beta: Insider Risk Cases](https://learn.microsoft.com/en-us/graph/api/resources/security-purviewinsiderriskcasesrecord?view=graph-rest-beta)

---

*Updated: May 2026 | Version: v1.6.2 | UI Verification Status: Current*

