Microsoft Purview: Insider Risk Management - Enhanced user profile in IRM alerts
We’re enhancing the User section within Insider Risk Management alerts to provide investigators with more contextual user profile and risk attributes directly within their workflow. With this update, analysts can now view key user details such as employee type, office location, s
DIGITAL SKILL WORKS LTD / 12 PANES
What it is
Microsoft Purview: Insider Risk Management - Enhanced user profile in IRM alerts is a Microsoft 365 roadmap item published via Microsoft Release Communications. Current status: Launched.
What it does
We’re enhancing the User section within Insider Risk Management alerts to provide investigators with more contextual user profile and risk attributes directly within their workflow. With this update, analysts can now view key user details such as employee type, office location, start date, policy inclusion, priority user group status, and last working day—helping them build a more complete understanding of the user during investigations without navigating away from the alert experience. This feature will be available as part of the new alert workflow through the Alert Details panel. Additional user attributes will continue to be introduced over time, with pseudo‑anonymization honored to support privacy‑by‑design investigation practices. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies based on their own internal policies, governance, and organizational requirements. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.
Why you should care
Board
Security/compliance control — fund Steady before more seats.
CISO
Prioritise as Steady control; wire into IR and GRC evidence paths.
CFO
Map licence or consumption impact to the frozen value case; avoid seat spray.
Adoption
Pilot with a named cohort and measure changed work, not vanity clicks.
Suggested action
Wave 0 first: Security → GRC → Cost & Value → Licence → Adoption. Decide: adopt for a named cohort, defer, or reject. If adopting, update licence and adoption plans in the same week.
12 Panes: 03 Horizon · 04 Security · 05 GRC · 08 Adoption
Communication needed
- Security: Lead review; confirm control mapping before enablement.
- GRC: Update AI/agent register and evidence path; confirm DPIA triggers if personal data is in scope.
- FinOps: Forecast seat or credit impact; align to frozen value case.
- Adoption: Plan cohort messaging, clinics, and success measures.
- Comms: One story for board and staff — what changes, what does not, who owns risk.
Benefits
- May improve productivity on a specific Microsoft 365 surface when permissions and data quality allow.
- Roadmap visibility helps Horizon planning without guessing dates.
Risks
- Status and dates change; treat MRC as directional, not a contract.
- Enabling without Steady controls can amplify overshare or cost leakage.
Source
- MRC id: 564619
- Status: Launched
- Products: Microsoft Purview
- GA / disclosure: October CY2026
- Preview: July CY2026
- Platforms: Web
- Cloud instances: Worldwide (Standard Multi-Tenant), GCC, GCC High, DoD
- moreInfoUrls: —
- Open on Microsoft 365 Roadmap
Microsoft Release Communications / Microsoft 365 Roadmap (AI at Work). Content is subject to Microsoft API Terms of Use. Dates and status change; verify in the official roadmap before acting.