Manage Risks, Alerts, and Activities
Insider Risk Management (IRM)
IRM policies are built from a template (for example, data theft by departing users, data leaks, security policy violations, or risky AI usage), a scope of users or groups, and a set of indicators with thresholds. Supporting settings decide anonymization of usernames, policy timeframes, and whether sequence detection is on. Alerts flow into triage, where an analyst confirms or dismisses them; confirmed alerts become cases with evidence, notes, and optional notice templates sent to the user. Adaptive protection publishes a user's IRM risk level so DLP and other controls can tighten automatically.
Audit, activity, and content
- Activity explorer shows what happened: label applied or changed, DLP rule matched, file accessed - typically a rolling 30-day window.
- Content explorer shows what is stored: items carrying a given sensitivity label or sensitive information type.
- Audit log retention is 180 days by default; Audit (Premium) extends to one year, or up to ten years when an audit retention policy is configured.
- Communication Compliance covers policy violations in communications (offensive language, sensitive data sharing), and eDiscovery handles searches and holds for investigations.
Traps
- An alert is only generated if alerting is configured in the DLP rule or IRM policy - a match alone may produce only an audit event.
- Anonymization hides usernames from IRM reviewers; it does not hide the actor in the audit log.
- Activity explorer answers "what did users do"; content explorer answers "where is the sensitive data".
- IRM policies need both indicators and thresholds; enabling an indicator with a threshold of zero produces noise, not signal.
Rule of thumb: alert → triage → case. If a question asks where to investigate, choose the case; if it asks where to review labels and matches at scale, choose activity or content explorer.