Insider Risk Management
Purview capability that detects risky user behavior, such as mass downloads shortly before someone resigns.
It correlates signals like unusual file access volume, copying to personal storage, and departure indicators from HR systems, then surfaces cases for review rather than blocking in the moment.
It carries genuine privacy weight, so it needs a defined policy, restricted access to the findings, and in many jurisdictions consultation before it is switched on.
Where this comes up
Insider Risk Management sits inside our microsoft 365 and cloud work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.