4.4MS-102Advanced
Est: ~15 mins•Verified: 2026-08

Purview: Insider Risk Management, Communication Compliance & Audit

Detect internal threat signals, protect intellectual property against departing employees using Microsoft Purview Insider Risk Management, enforce regulatory messaging policies with Communication Compliance, and configure Audit (Premium).

Tags:#Microsoft 365#MS-102#Purview#Insider Risk#Communication Compliance#Audit Premium#Compliance
01

Overview

External threats are only half the enterprise security equation. Internal data theft, accidental leaks, workplace harassment, and regulatory non-compliance represent critical risks. Microsoft Purview provides specialized risk and compliance solutions:

  1. Insider Risk Management (IRM): Correlates user signals across Microsoft 365, endpoints, and HR systems (e.g., resignation notices) to detect high-risk activity like data exfiltration by departing employees, copying sensitive files to USB/cloud storage, or mass downloading files before resigning.
  2. Communication Compliance: Analyzes internal and external communications across Microsoft Teams, Exchange Online, Yammer/Viva Engage, and third-party platforms to detect code-of-conduct violations, offensive language, regulatory disclosure, and insider trading.
  3. Microsoft Purview Audit (Standard vs Premium):
  • Audit (Standard): Retains audit logs for 180 days across basic operations.
  • Audit (Premium): Retains logs for 1 year (expandable up to 10 years), logs high-value security events like MailItemsAccessed (critical for business email compromise forensics) and Send events, and offers higher Graph Audit API bandwidth.

---

02

When to Use: Purview Solution Selection

Risk ScenarioSolutionRecommended Policy Template
Sales manager submits resignation and downloads confidential client listsInsider Risk ManagementData leaks by departing users (triggered by HR resignation connector).
Employees sharing offensive language, threats, or harassment in Microsoft TeamsCommunication ComplianceDetect offensive or threatening language (built-in ML classifier).
Forensic investigation to determine exactly which emails a threat actor readPurview Audit (Premium)Query MailItemsAccessed in Audit log search.
User downloading excessive files marked with 'Confidential' sensitivity labelInsider Risk ManagementData leaks by priority users / sensitive files.

---

03

Prerequisites

Administrator Permissions:

  • Insider Risk Management Admin or Compliance Administrator.
  • Communication Compliance Admin or Reviewer.
  • Microsoft 365 E5 or Microsoft Purview Compliance E5 license.

---

04

Portal Path

TEXT
Microsoft Purview Portal (https://purview.microsoft.com)
├── Insider risk management
│   ├── Policies (Create policy based on pre-defined templates)
│   ├── Alerts (Review prioritized risk alerts with 0-100 risk score)
│   └── Cases (Escalate high-risk incidents to Legal / HR case)
├── Communication compliance
│   ├── Policies (Configure Teams / Exchange monitoring conditions)
│   └── Pending review (Investigate flagged messages and remediate)
└── Audit
    ├── Search (Run unified audit log query across Exchange, SharePoint, Teams)
    └── Audit retention policies (Create 1-year to 10-year retention rules)

---

05

Step-by-Step Implementation

Step 1: Deploy an Insider Risk Policy for Departing Employees

  1. In Microsoft Purview, navigate to Insider risk management > Policies > + Create policy.
  2. Select template: Data leaks by departing users.
  3. Policy name: IRM-Departing-Employee-Data-Exfiltration.
  4. Users: Select All users and groups.
  5. Triggering event:
  • Option A: Connect to HR connector (CSV import of resignation dates).
  • Option B: Trigger when a user account is scheduled for deletion in Entra ID.
  1. Indicators: Check:
  • Downloading content from SharePoint Online.
  • Copying files to USB personal storage.
  • Uploading files to personal cloud storage (e.g. Google Drive, Dropbox).
  1. Detection window: Set past window to 30 days and future window to 30 days.
  2. Review and click Submit.

Step 2: Configure a Teams Communication Compliance Policy

  1. Navigate to Communication compliance > Policies > + Create policy.
  2. Template: Detect offensive or threatening language.
  3. Name: Teams-Workplace-Code-Of-Conduct.
  4. Supervised users: All internal users.
  5. Reviewers: HR Security & Compliance Reviewers group.
  6. Locations: Microsoft Teams (Chats and Channels).
  7. Review percentage: 10% sample of non-matching or 100% of flagged matches.
  8. Click Create policy.

Step 3: Configure Purview Audit (Premium) 1-Year Retention

  1. Navigate to Audit > select Audit retention policies tab.
  2. Click + Create audit retention policy.
  3. Policy name: Audit-Retention-Executive-Accounts.
  4. Users: Select C-suite executives and Cloud Administrators.
  5. Record types: ExchangeItem, AzureActiveDirectory, SharePointFileOperation.
  6. Duration: Select 1 year (or up to 10 years with add-on license).
  7. Priority: 100. Save policy.

---

06

PowerShell Scripts

PowerShell: Search Audit Log for Compromised Mailbox Access (MailItemsAccessed)

PowerShell
# Connect to Exchange Online PowerShell
Connect-ExchangeOnline -UserPrincipalName "admin@contoso.com"

# 1. Forensic search: Detect when a compromised account read specific email items
$startDate = (Get-Date).AddDays(-7).ToString("MM/dd/yyyy")
$endDate = (Get-Date).ToString("MM/dd/yyyy")
$targetMailbox = "ceo@contoso.com"

Write-Host "Searching Audit Log for MailItemsAccessed on $targetMailbox..." -ForegroundColor Cyan

$auditResults = Search-UnifiedAuditLog `
    -StartDate $startDate `
    -EndDate $endDate `
    -Operations "MailItemsAccessed" `
    -FreeText $targetMailbox `
    -ResultSize 500

$auditResults | ForEach-Object {
    $auditData = $_.AuditData | ConvertFrom-Json
    [PSCustomObject]@{
        Timestamp     = $_.CreationDate
        Operation     = $_.Operations
        UserId        = $_.UserIds
        ClientIP      = $auditData.ClientIPAddress
        LogonType     = $auditData.LogonType
        FoldersCount  = $auditData.Folders.Count
    }
} | Format-Table -AutoSize

---

07

Verification Checklist

VERIFICATION CHECKLIST
0/5 (0%)
HR connector actively syncs resignation records or employee termination dates.
Users copying bulk data to USB on Windows endpoints trigger IRM alerts within 24 hours.
Offensive keywords in Teams chat flag instantly and queue in Communication Compliance pending review.
Communication Compliance reviewers can notify user, escalate to legal, or remove message in Teams.
Audit log searches return MailItemsAccessed events for Audit (Premium) licensed accounts.
08

Common Pitfalls & Troubleshooting Matrix

IssueRoot CauseResolution
Insider risk alerts show 'User 1, User 2' anonymizedAnonymization is enabled in Insider Risk global settings for privacy.Navigate to IRM Settings > Privacy > uncheck Show anonymized versions of display names.
No MailItemsAccessed events returned in Audit searchUser does not have Microsoft 365 E5 or Audit (Premium) license assigned.Verify user licensing; Audit (Standard) does not capture MailItemsAccessed or Send events.
Communication compliance reviewer cannot view messageReviewer lacks the Communication Compliance Reviewer role in Purview permissions.Assign the reviewer role in Purview Portal > Roles and scopes.
HR resignation events fail to trigger IRM policyHR CSV schema does not match required headers (Email, ResignationDate).Ensure CSV header exactly matches Microsoft Purview schema (ResignationDate format yyyy-MM-ddTHH:mm:ssZ).

---

09

Real-World Architecture / Flow

Interactive Topology & Workflow
Microsoft Purview Insider Risk Architecturesecurity
Stage 1

---

10

Audit & Monitoring

  • Monitor Audit searches and export activities:
  • Event: Search-UnifiedAuditLog execution.
  • Monitor access to sensitive compliance cases:
  • Audit logs track who accessed Insider Risk Management cases or Communication Compliance transcripts.

---

11

Rollback & Emergency Recovery

  • Dismiss False Positive IRM Alert:
  • Open the alert > click Dismiss alert > provide rationale (e.g., "Legitimate business backup authorized by IT").
  • Remove Message from Teams:
  • In Communication Compliance review > select message > click Remove message in Teams to replace with compliance tombstone.

---

12

Official Documentation Reference

---

13

Exam Blueprint & Pro Tips (MS-102)

Exam Blueprint & High-Yield Traps

MS-102 High-Yield Rules:

  1. MailItemsAccessed Forensic Value: In business email compromise (BEC) investigations, MailItemsAccessed is the only event that proves whether an attacker actually read specific emails or just accessed the mailbox.
  2. Audit (Standard) vs (Premium): Standard retains logs for 180 days. Premium retains for 1 year by default (extendable to 10 years).
  3. Privacy Anonymization: IRM anonymizes usernames by default in tenant settings to prevent bias; admins can disable this if organizational policy allows.
  4. Communication Compliance Scope: Can monitor internal users, external guest users, or groups, and supports sentiment analysis, image matching (OCR), and custom regex patterns.
PREVIOUS TOPIC4.3 Purview Data Lifecycle: Retention & eDiscovery