Quick answer. As of September 2026, turn on Microsoft Purview Insider Risk Management only as a scoped pilot that information technology, compliance, privacy, security, human resources and legal have agreed, which is the stakeholder list Microsoft itself gives in Plan for Insider Risk Management, and in GCC High confirm availability in your own tenant first, because Microsoft’s pages disagree: its Microsoft Copilot service description, last updated August 5, 2026, says “Insider Risk Management isn’t currently available for GCC-High.”, while its Purview planning page for GCC High, last updated May 21, 2025, lists features such as data theft by departing users as Available. According to Microsoft, users are pseudonymized by default, global administrators don’t have access by default, and forensic evidence is off by default with dual authorization required to create its policies. Before the pilot starts, confirm the audit log is on and, for the departing-user template, configure the Microsoft 365 HR connector.
The request usually arrives after a security review or an auditor asks how the organization would know if a departing employee took data with them, and someone notices the license already includes a tool for it. It is tempting to treat that tool as a setting in the Microsoft Purview portal. It is not: it looks at what named employees do, so the people who answer for employee relations, privacy and legal exposure have to agree to it before anyone opens the policy wizard. In a government cloud there is a second question, and Microsoft answers it two ways on its own pages. This guide sets out what Microsoft says the tool does, who it says to involve, the privacy defaults, what must be in place first, and what each Microsoft page says about GCC High, with the date each page shows.
Why the approval is not IT’s decision alone
If the program starts as a quiet configuration change, there is no answer ready the first time an employee, a works council or a privacy officer asks who approved it. Microsoft’s Learn about Insider Risk Management page, last updated June 26, 2026, describes what the tool does: “Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations.” and “Insider Risk Management enables customers to create policies to manage security and compliance.”
Those policies are about people. The Microsoft Purview service description, last updated August 3, 2026, says “Insider Risk Management policies must be created in the Microsoft Purview compliance portal and assigned to users.” Microsoft’s privacy guide for the solution, last updated August 20, 2025, says “An admin with the right permissions can explicitly scope employees into a policy.” and “Insider risk management and communication compliance don’t detect those activities without an admin’s explicit opt-in.”
So every pilot is a decision about which employees are in scope and which of their activities are watched. Write down which users and which indicators the pilot covers before anyone opens the policy wizard, and put that list in front of the people who have to agree to it.
Who signs off, and in what order
If one team switches the program on and the others learn about it later, the approval has already failed. Microsoft’s Plan for Insider Risk Management, last updated August 20, 2025, says “Identify the appropriate stakeholders in your organization to collaborate for taking actions on Insider Risk Management alerts and cases.” and then lists the areas to include in initial planning and in the end-to-end workflow:
- Information technology
- Compliance
- Privacy
- Security
- Human resources
- Legal
The same page puts a pilot before the broad rollout: “Before enabling this solution broadly in your production environment, consider testing the policies with a small set of production users so you can complete the necessary compliance, privacy, and legal reviews in your organization.” From that, an IT leader can run a sequence, fitted to the organization’s own approval process: agree the scope with the six areas, pilot with a small set of production users, finish the compliance, privacy and legal reviews during the pilot, and only then widen the policies.
What each area signs is its own organization’s call. The table below describes what each one is usually asked to agree to; it is not a statement of what any law requires.
| Area (Microsoft’s list) | What it agrees to before the pilot |
|---|---|
| Information technology | The tenant configuration, the prerequisites and who holds the admin roles |
| Compliance | Which policies and indicators the pilot uses, and how cases are recorded |
| Privacy | Which users are in scope, and who can see names during the pilot |
| Security | How alerts are triaged inside the organization, and the link to data loss prevention |
| Human resources | The HR data the connector imports, and how a case reaches an employee process |
| Legal | Retention of case data and employee notice, as the organization’s own policy decides |
Get the six sign-offs in writing, with the pilot’s user list and indicator list attached, before the first policy is created.
The privacy defaults you can show HR and legal
When HR and legal first see the plan, they usually ask the same question: who will see employee names? Microsoft’s answer starts with its defaults. The Learn about Insider Risk Management page says “Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.” The privacy guide says “By default, global administrators don’t have access to insider risk management and communication compliance features.”
Forensic evidence, which captures activity for review, has its own controls. Microsoft’s Learn about Insider Risk Management forensic evidence, last updated August 20, 2025, says “Forensic evidence is off by default, policy creation requires dual authorization and usernames can be masked with pseudonymization (which is on by default for Insider Risk Management).”
For the pilot itself, Microsoft’s Plan for Insider Risk Management says “Keep the anonymization feature in policy settings enabled to anonymize user display names in the Insider Risk Management console during this testing to maintain privacy within the tool.”
There is one limit to show them. If Adaptive Protection is later used to apply data loss prevention or Conditional Access policies by risk level, Microsoft’s Adaptive Protection page, last updated June 26, 2026, says “User names aren’t anonymized in Conditional Access or data loss prevention.” And when a case needs a legal hold or a wider search, the Learn about Insider Risk Management page says “You can also set up processes for acting on cases and escalating cases to Microsoft eDiscovery (Premium) if needed.”
Leave pseudonymization on for the pilot, keep global administrators out of the role groups, leave forensic evidence off unless the sponsors approve it, and name who may turn any of those settings off.
What must be in place first, and the license
If a pilot starts before its data sources are in place, its early alerts tell the sponsors nothing useful. Microsoft’s Get started with Insider Risk Management, last updated November 14, 2025, says “Insider Risk Management uses Microsoft 365 audit logs for user insights and risk management activities identified in policies and analytics insights.” It also says “To access and configure recommended actions, users must be assigned to the Insider Risk Management or Insider Risk Management Admins role groups.”
The departing-user template needs HR data. Microsoft’s Plan for Insider Risk Management says “For the Data theft by departing users template, configure a Microsoft 365 HR connector to periodically import resignation and termination date information for users in your organization.” That connector is the point where HR’s sign-off becomes a data flow, so it belongs in HR’s agreement.
On licensing, the Microsoft Purview service description lists Insider Risk Management under “Microsoft 365 E5/A5/G5, Microsoft Purview Suite/EDU/GOV/FLW and Microsoft Defender + Purview Suite FLW, and Microsoft 365 E5/A5/F5/G5 Insider Risk Management”. Confirm which of those your users hold with your Microsoft licensing contact; whether to move a population to a higher tier is covered in Microsoft 365 E3 vs E5 Cost: What E5 Really Costs and When to Upgrade.
Confirm the audit log, the role group assignments and the HR connector before the pilot’s start date, and record each with its date.
Does it run in GCC High? What Microsoft’s own pages say
If your GCC High plan rests on one Microsoft page, the next page a reviewer opens can contradict it. As of this guide’s read on September 24, 2026, three Microsoft pages answer the question differently:
| Microsoft page | Last updated (as Learn shows it) | What it says |
|---|---|---|
| Microsoft Copilot service description | August 5, 2026 | In a footnote to the Microsoft Purview controls for Microsoft Copilot & Copilot chat row: “Insider Risk Management isn’t currently available for GCC-High.” |
| Help dynamically mitigate risks with Adaptive Protection | June 26, 2026 | In one notice: “Insider Risk Management is currently available in tenants hosted in geographical regions and countries supported by Azure service dependencies.” and “Insider Risk Management is available for commercial clouds but isn’t available for US Government cloud programs at this time.” |
| Plan for Microsoft Purview compliance and risk management solutions, GCC High deployments | May 21, 2025 | Under a heading that includes “Understand which capabilities are currently unavailable or disabled by default in Microsoft 365 Government” and names GCC-High, the Microsoft Purview Insider Risk Management area lists features with a status each, including “Data theft by departing users” and “General data leaks” as Available, with the footnote “Identified status is subject to change as project plans and priorities are reevaluated.” |
The Copilot service description says of its own table: “The table below shows availability as of the last update date for the Service Description”. It is the most recently updated of the three.
In the GCC High planning page, according to Microsoft’s table, the Insider Risk Management area has 40 feature rows: 15 Available, 14 In development, 10 Public Preview and 1 Rolling out. Rows it lists as Available include “Forensic evidence”, “Case dashboard” and “Escalate for investigation for eDiscovery (Premium)”. Rows it lists as In development include “Data leaks by disgruntled users” and “Indicators for Microsoft Defender for Endpoint alerts”; “Priority user groups” is listed as Public Preview. The table has no row for Adaptive Protection.
A fourth page assumes the tool exists on both sides. Microsoft’s Plan for Insider Risk Management says “If you migrate your organization from the Microsoft 365 US Government Cloud to the worldwide commercial cloud or from the worldwide commercial cloud to the Government Cloud, active cases and alerts don’t migrate.” and “Close any alerts and cases before starting the migration.”
None of the Microsoft pages read for this guide reconciles these statements, and this guide does not pick one. Check the Insider Risk Management area in your own GCC High tenant, confirm in writing with Microsoft which features are available to you, and date that confirmation before the pilot is approved. Plan around any template the GCC High planning page lists as In development or Public Preview rather than promising it to the sponsors. If the tenant is still moving to GCC High, the migration itself is covered in Microsoft 365 GCC High Migration Checklist: Best Practices for Defense Contractors.
Adaptive Protection: where insider risk levels meet data loss prevention
Once a pilot produces risk levels, the next request is to act on them automatically. Microsoft’s Adaptive Protection page says “Adaptive protection dynamically assigns appropriate data loss prevention, data lifecycle management, and Conditional Access policies to users based on the insider risk levels defined and analyzed by the machine learning models in Insider Risk Management.” That ties the pilot to your data loss prevention policies, so the DLP owner joins the sign-off before Adaptive Protection is switched on, and tuning those policies so they do not flood users is a separate piece of work. The same page carries the government-cloud sentence quoted in the table above.
Treat Adaptive Protection as a second decision, taken after the pilot, with the privacy owners told that user names are not anonymized in the policies it drives.
When this plan is the wrong frame
If any of the conditions below applies, do not start a pilot yet; saying so early costs less than stopping one halfway.
- If HR, legal or privacy will not agree a scope, do not start. A program switched on without them skips the stakeholder planning and the small-pilot testing Microsoft advises.
- If you are still deciding whether you need GCC High at all, settle that first; the question is covered in Does CMMC Require GCC High? What the Rule Actually Requires for Defense Contractors.
- If your tenant shows the templates you need as unavailable, the program is a planning exercise until Microsoft ships them. Say so to the sponsors rather than promising detection; Microsoft’s GCC High planning page itself says “Identified status is subject to change as project plans and priorities are reevaluated.”
- If what you need is supervision of regulated communications rather than data-risk detection, that is a different Purview solution: Microsoft’s privacy guide describes Microsoft Purview Communication Compliance separately.
What to require before the pilot starts
If the pilot is approved on a verbal agreement, it is hard to defend later. Require these before the first policy is created:
- Written sign-off from information technology, compliance, privacy, security, human resources and legal.
- A named list of the users in scope and the indicators the policies use.
- Pseudonymization left on for the pilot, and a named person who may change it.
- A named owner for triage inside the organization, and a documented path from a case to HR and legal.
- The tenant availability check, recorded with its date, for any government cloud.
- An exit rule: the date and the conditions on which the pilot ends, widens or stops.
How i3solutions answers
When a pilot has to satisfy six sign-offs and a government cloud, most of the work is the configuration record behind it. i3solutions designs and configures Microsoft Purview Insider Risk Management as project work, with embedded Purview specialists inside your team where you need them. i3solutions maps governance to named control families, enforces it in the platform through Entra ID, Purview, and Azure Policy, and evidences it continuously rather than reconstructing it at audit.
For a pilot, that project covers the policies, the role groups, the Microsoft 365 HR connector, the privacy settings and the pilot scope, documented so the six sign-offs have something concrete to approve. i3solutions engages its Federal Compliance Assessment when the scope spans a FedRAMP Moderate or FedRAMP High boundary, or when the client operates in a GCC High tenant. The people doing the work are senior and US-based. i3solutions does not monitor or triage insider-risk alerts, or run investigations, as an ongoing managed service; that work stays with your own designated owners, and decisions about employees stay with your HR and legal teams.
The wider Purview service is described in Microsoft Purview Technology Readiness Services, and bringing specialists into your team is covered in Hire Microsoft Purview Compliance Consultants. The governance practice behind both is described in Embedding Governance into How the Enterprise Operates and Scales.
Key Takeaways
- Microsoft’s planning guidance names six areas to involve: information technology, compliance, privacy, security, human resources and legal.
- Microsoft advises testing with a small set of production users so the compliance, privacy and legal reviews can finish before a broad rollout.
- According to Microsoft, users are pseudonymized by default, global administrators don’t have access by default, and forensic evidence is off by default.
- The departing-user template needs the Microsoft 365 HR connector, and the tool relies on Microsoft 365 audit logs.
- In GCC High, Microsoft’s Copilot service description (last updated August 5, 2026) says Insider Risk Management “isn’t currently available for GCC-High”, its Adaptive Protection page (June 26, 2026) says it “isn’t available for US Government cloud programs at this time”, and its GCC High planning page (May 21, 2025) lists features as Available; check your own tenant and get Microsoft’s answer in writing.
Frequently Asked Questions
Is Microsoft Purview Insider Risk Management available in GCC High?
Microsoft’s own pages disagree, so check your tenant. The Microsoft Copilot service description, last updated August 5, 2026, says “Insider Risk Management isn’t currently available for GCC-High.” The Adaptive Protection page, last updated June 26, 2026, says “Insider Risk Management is available for commercial clouds but isn’t available for US Government cloud programs at this time.” The Purview planning page for GCC High, last updated May 21, 2025, lists features such as data theft by departing users as Available and says “Identified status is subject to change as project plans and priorities are reevaluated.”
Who should approve an Insider Risk Management program?
The six areas Microsoft names, before a small pilot. Microsoft’s Plan for Insider Risk Management, last updated August 20, 2025, says “Identify the appropriate stakeholders in your organization to collaborate for taking actions on Insider Risk Management alerts and cases.” and lists information technology, compliance, privacy, security, human resources and legal. It adds “Before enabling this solution broadly in your production environment, consider testing the policies with a small set of production users so you can complete the necessary compliance, privacy, and legal reviews in your organization.”
Can Insider Risk Management analysts see employee names?
Not by default. Microsoft says “Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.” Its privacy guide, last updated August 20, 2025, says “By default, global administrators don’t have access to insider risk management and communication compliance features.” For a pilot, Microsoft says “Keep the anonymization feature in policy settings enabled to anonymize user display names in the Insider Risk Management console during this testing to maintain privacy within the tool.” With Adaptive Protection, Microsoft says “User names aren’t anonymized in Conditional Access or data loss prevention.”
What do we need before the departing-employee policy works?
The audit log and the HR connector. Microsoft’s Get started with Insider Risk Management, last updated November 14, 2025, says “Insider Risk Management uses Microsoft 365 audit logs for user insights and risk management activities identified in policies and analytics insights.” Its Plan for Insider Risk Management says “For the Data theft by departing users template, configure a Microsoft 365 HR connector to periodically import resignation and termination date information for users in your organization.”
Is forensic evidence on by default?
No. Microsoft’s Learn about Insider Risk Management forensic evidence, last updated August 20, 2025, says “Forensic evidence is off by default, policy creation requires dual authorization and usernames can be masked with pseudonymization (which is on by default for Insider Risk Management).”
Planning the Decision
If your team needs a pilot scope, the six sign-offs and a dated availability check in your tenant settled before anything is switched on, the next step is a conversation about your estate.
