Microsoft Purview compliance portal: Collection policies impact on IRM [MC1051100]

Message ID: MC1051100

With this update, Microsoft Purview will start supporting collection policies. Collection policies allow customers to scope classification (SITs – Sensitive Information Types) and activities for scoped users. We recommend reviewing collection policies as they can be created by different Purview solution admins to ensure they are setup to detect the activities required by IRM policies. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies to manage security and compliance. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.

This message is associated with Microsoft 365 Roadmap ID 484082

[When this will happen:]

Public Preview (Worldwide): We will begin rolling out on early April 2025 and expect to complete by mid-April 2025.

General Availability (Worldwide): We will begin rolling out on late September 2025 and expect to complete by late September 2025.

[How this will affect your organization:]

Collection policies modify the default full audit behavior of endpoint workload. If collection policies are not being used for endpoint, then there is no impact to IRM. But in case collection policies are being used, please ensure that the created collection policies cover the device indicators mentioned in IRM policies. If not, IRM policies will not function as intended.

[What you need to do to prepare:]

If the default full audit behavior of endpoint works for your organization, then no change is needed. If you want to modify that, then list the activities you want to monitor in IRM and ensure collection policy covers them.

Source: Microsoft

Mike Rosoft

9 April 2025, 5:49 pm

The recent update to the Microsoft Purview compliance portal introduces collection policies that are set to have a significant impact on both admins and users alike. For admins, the ability to scope classification and activities for specific users will enhance the monitoring capabilities for Insider Risk Management (IRM). This means that admins can tailor their approach to detecting potential insider threats, such as data leakage or security violations, with greater accuracy. It’s a bit like having a finely-tuned instrument in an orchestra – when each part is in harmony, the overall performance is much more effective!

For users, the impact is more about reassurance than restriction. With privacy by design, users will be pseudonymized by default, which means their personal information remains protected while still allowing for necessary oversight. This is a win-win situation – users can feel secure knowing that their data is being handled responsibly, while organizations can ensure compliance and security.

The changes are set to roll out in phases, with public preview starting in April 2025 and general availability by September 2025. So, there’s plenty of time for organizations to prepare. If your organization currently relies on the default full audit behavior of endpoints, you might not need to change anything. However, if you’re looking to fine-tune your monitoring, now is the time to start listing the activities you want to keep an eye on.

In summary, this update is poised to make a meaningful difference in how organizations manage insider risk while protecting user privacy. It’s a step forward in fostering a collaborative and secure environment.

What do you think about these changes? Are you excited, or do you have concerns? Let’s hear your thoughts in the comments! For more insights and discussions, be sure to check out other posts on mwpro.co.uk.

1 Comment

Mike Rosoft


9 April 2025, 5:49 pm

The recent update to the Microsoft Purview compliance portal introduces collection policies that are set to have a significant impact on both admins and users alike. For admins, the ability to scope classification and activities for specific users will enhance the monitoring capabilities for Insider Risk Management (IRM). This means that admins can tailor their approach to detecting potential insider threats, such as data leakage or security violations, with greater accuracy. It’s a bit like having a finely-tuned instrument in an orchestra – when each part is in harmony, the overall performance is much more effective!

For users, the impact is more about reassurance than restriction. With privacy by design, users will be pseudonymized by default, which means their personal information remains protected while still allowing for necessary oversight. This is a win-win situation – users can feel secure knowing that their data is being handled responsibly, while organizations can ensure compliance and security.

The changes are set to roll out in phases, with public preview starting in April 2025 and general availability by September 2025. So, there’s plenty of time for organizations to prepare. If your organization currently relies on the default full audit behavior of endpoints, you might not need to change anything. However, if you’re looking to fine-tune your monitoring, now is the time to start listing the activities you want to keep an eye on.

In summary, this update is poised to make a meaningful difference in how organizations manage insider risk while protecting user privacy. It’s a step forward in fostering a collaborative and secure environment.

What do you think about these changes? Are you excited, or do you have concerns? Let’s hear your thoughts in the comments! For more insights and discussions, be sure to check out other posts on mwpro.co.uk.

1 Comment

Leave a Reply Cancel reply