Understand risky internal activity
Insider Risk Management
Last reviewed
Ghani Governance configures Microsoft Purview Insider Risk Management and the governance around it for UK organisations. The work is choosing which scenarios matter, keeping signals proportionate, and giving investigators a fair path. Enabling every indicator is not a programme. Privacy and DPO review is part of the design, not a slide at the end.
Insider risk with a purpose and an owner
Microsoft Purview Insider Risk Management can surface patterns that may point to data theft, inappropriate access or careless handling. Enabling every indicator is not a programme. The work is deciding which scenarios matter, who reviews alerts, and how a case moves to HR or legal without becoming a fishing expedition.
Ghani Governance configures the product and the governance around it. The DPO / privacy-counsel overlay is part of the design, not a slide at the end. Product references: Microsoft’s Insider Risk documentation and the Insider Risk Management get-started guide.
What we set up
Risk scenarios
Departure-window data movement, unusual downloads, repeated access to a protected store — each policy has a written purpose.
Policy configuration
Scope, indicators, triggering events and thresholds aimed at usable cases, not volume.
Investigation workflow
Who opens a case, what they may see, and how it escalates or closes.
HR, legal and DPO overlay
Fairness, retention of investigative material, and a path that can be explained if challenged.
Testing and tuning
Alert quality reviewed before the population grows.
Communication Compliance · DLP implementation · Policy to Purview design · eDiscovery · DSPM for AI · All Purview services
Indicative ranges
| Service | Planning range | Typical mid-point |
|---|---|---|
| Insider Risk readiness review | £1,500–£3,000 | £2,250 |
| Pilot policy implementation | £3,000–£6,000 | £4,500 |
| Multi-scenario implementation | £6,000–£12,000 | £9,000 |
Indicative only. Scope, licensing, stakeholders and existing controls change the figure. Not a quote.
Process
Define scenarios
Behaviours and data types that justify monitoring.
Prerequisites
Licensing, audit, permissions, related Purview controls.
Pilot policies
A controlled group or one scenario first.
Review
Case quality and false positives before expansion.
Govern
Ownership, review cadence, change control.
Insider Risk questions
Is Insider Risk the same as DLP?
No. DLP looks at content leaving a channel. Insider Risk looks at patterns of user activity that may indicate theft, leakage or policy abuse. They share data; they are not substitutes.
How do you keep this proportionate?
We define the scenarios that justify monitoring, set indicators against those scenarios, and agree who may open a case. HR and the DPO are in that conversation. Broad “watch everyone” configurations are how these programmes lose legitimacy.
Related Purview services
Other Ghani Governance Microsoft Purview services on this hub that often sit alongside Insider Risk Management:
- Communication Compliance — policy-based review of communications that can share signals with insider-risk cases
- Microsoft Purview DLP implementation — outbound sensitive-content controls that Insider Risk does not replace
- Policy to Purview design — mapping written policies before risk scenarios are switched on
- Microsoft Purview eDiscovery — holds and collections when a matter needs a formal case path
- DSPM for AI — AI interaction risk where Copilot or agents are in scope
- All Microsoft Purview services — full hub list
Book a discovery workshop
A scoping conversation about what you need to protect, what is already configured, and what must not break.