The riskiest month for your company data is the one between an employee's resignation and their last day. IT Partner implements Microsoft Purview Insider Risk Management in your tenant in 4 weeks for a fixed $4,950: policies for data theft by departing users and risky exfiltration, the HR connector that tells Purview who is leaving, privacy-by-default configuration that pseudonymizes users until a case warrants review, a triage workflow your team can actually run, and integration with DLP and Conditional Access through Adaptive Protection where your licensing supports it. It is a technical implementation — not employment-law advice and not a monitoring service we run for you.
Most insider incidents in small and mid-size organizations follow the same script: an employee accepts an offer elsewhere, and in the weeks before departure the client lists, drawings, price books, or source files walk out — to a USB drive, a personal cloud account, or a forwarded mailbox. Individually, each of those events looks like normal work. That is why plain alerting misses them. Microsoft Purview Insider Risk Management approaches the problem differently: instead of firing an alert on every download, it correlates signals over time — downloads, uploads to personal cloud services, printing, archive creation, mass deletions, label downgrades — into a per-user risk score, and raises an alert when a pattern crosses the thresholds you set. IT Partner implements that machinery properly: audit and permission prerequisites, the Insider Risk Management role groups so access to investigations is need-to-know, privacy settings with pseudonymized usernames on by default, the HR connector feed so resignation and termination dates become policy triggers, and tuned policies built on the Data theft by departing users and Data leaks templates. Where your licensing supports it, we enable Adaptive Protection, so a user's insider-risk level dynamically tightens DLP policies and can block elevated-risk sign-ins through a Microsoft Entra Conditional Access policy. Two things this service deliberately is not. It is not employee surveillance dressed up as security: pseudonymization, role-gated access, and an audited investigation trail are configured from day one, and your HR and legal stakeholders are in the design sessions. And it is not an employment-policy engagement — what your organization is permitted to monitor, and what it does when a case is confirmed, are decisions for your counsel. We build the detection and the process; you own the policy.
Confirm licensing coverage for every user in policy scope, verify audit is enabled and flowing, configure role groups, and hold the design session with security, HR, and legal stakeholders — including the pseudonymization decision and the monitoring-disclosure question the client owns.
Configure policy indicators, connect the HR connector and validate a test upload, confirm device onboarding for endpoint signals where Microsoft Defender for Endpoint is present, and run the insider risk analytics scan to baseline current tenant behavior.
Create the Data theft by departing users and Data leaks policies with agreed scope, triggering events, and priority content. Policies run in a scoring-only posture while the risk engine accumulates enough activity to evaluate.
Review early scoring against known-good activity, adjust thresholds and exclusions to cut noise, configure notice templates, and walk the client's analysts through alert triage, case handling, and escalation on live data.
Where licensed and approved: define risk levels, connect them to the agreed DLP policies, and create the Conditional Access policy for elevated-risk users in report-only mode, with exclusions for emergency access accounts verified before anything is enforced.
Execute the agreed simulated-exfiltration test cases, confirm detections and alert quality, deliver the configuration summary and triage runbook, and hand the alert queue to the client's named analysts.
It is the Purview solution that correlates user activity signals — downloads, uploads to personal cloud services, USB copies, printing, mass deletions, label downgrades — into a per-user risk score over time, and raises an alert when a pattern crosses your thresholds. The canonical case it exists for is the departing employee taking client data on the way out: individually normal-looking events that only look like theft when correlated. This service implements it end to end in your tenant in 4 weeks.
Every user in scope of an insider risk policy needs Microsoft 365 E5, A5, or G5 — or Microsoft 365 E3 plus the E5 Compliance add-on, or the standalone E5 Insider Risk Management add-on. We verify coverage in week 1, before any configuration, and give you in writing exactly which users are covered and which are not. The Conditional Access integration additionally requires Microsoft Entra ID P2, which Microsoft 365 E5 includes.
No, but it needs an add-on decision first. The E5 Compliance add-on or the E5 Insider Risk Management add-on on top of E3 licenses the capability for the users you assign it to — many clients license their highest-risk population rather than everyone. We model the options in the week-1 licensing review, and if the add-on economics do not make sense for your situation we will say so before you have spent anything on configuration.
The Data theft by departing users policy needs to know who is departing. The HR connector is a scheduled feed — an app registration plus an export your HR system or process produces — that delivers resignation and termination dates to Purview, so risk scoring around a departure starts when notice is given, not when IT eventually disables the account. If you genuinely cannot produce an HR feed, we configure the Microsoft Entra account-deletion fallback trigger and document its key weakness: it fires at deprovisioning, after the risky window has mostly passed.
Three ways, configured from day one: usernames in alerts and cases are pseudonymized by default, so analysts triage patterns rather than names until a case justifies revealing the user; access to insider-risk data is restricted to the named role groups we configure; and investigator actions are themselves audited. Whether and how you disclose monitoring to employees is an employment-policy decision that stays with you and your counsel — we build the controls, not the policy.
That depends on your jurisdictions, your workforce agreements, and in some countries on employee-representative consultation — which is exactly why we will not answer it for you, and why legal advice is explicitly out of scope. What we do provide: privacy-protective defaults, a design session where your HR and legal stakeholders see precisely what is collected and who can see it, and documentation your counsel can review. Most US-based SMB clients proceed comfortably; multinational tenants usually scope policies by country after taking advice.
DLP evaluates single events against content rules — this file, this action, block or allow. Insider Risk Management evaluates people over time — sequences and volumes of activity that are individually permitted but collectively alarming. They are designed to work together: a DLP alert can be the triggering event for the Data leaks policy, and with Adaptive Protection a user's risk level dynamically moves them into stricter DLP enforcement. If your DLP itself is thin, start with our DLP configuration service; this engagement integrates with it rather than replacing it.
With Adaptive Protection enabled, Purview assigns users minor, moderate, or elevated risk levels based on policy activity. Microsoft Entra Conditional Access can use that insider-risk level as a policy condition — for example, blocking sign-ins or requiring stricter terms for elevated-risk users. It is generally available from Microsoft, requires Entra ID P2, and we deploy it in report-only mode with emergency-access exclusions verified before you decide to enforce it.
Honestly: not on day one. The analytics baseline needs roughly the first two weeks of the engagement, policies then accumulate scoring, and threshold tuning in week 3 is what turns raw detections into a reviewable queue. By handover in week 4 you have validated detections from simulated scenarios and a tuned live queue — and alert quality keeps improving as the engine sees more of your normal.
Your team, using the triage runbook and the training session included in the engagement — this service deliberately builds an in-house capability rather than a dependency on us. Ongoing triage by IT Partner is not included; if you want managed eyes on the queue, that is a separate conversation we are happy to have, priced as its own service.
No. Forensic evidence is a separate Purview add-on with its own opt-in, its own capacity-based licensing, and materially heavier privacy implications than pseudonymized activity scoring. We exclude it from the fixed scope on purpose. If you need it, we scope it as an add-on after the base implementation is stable and your counsel has reviewed the implications.
We agree a test plan with you in week 3 — typically a test account mimicking a departing user: bulk downloads from SharePoint, a copy to USB on an onboarded device, an upload to a personal cloud service, and archive creation. We then verify the policies scored and alerted as designed, and the results go into the configuration summary as evidence the deployment detects what it claims to.
You own a running, tuned insider-risk capability: two live policies, a triage-trained team, a documented configuration, and — where enabled — Adaptive Protection connected to DLP and Conditional Access. Ongoing ownership means keeping the HR feed flowing, maintaining licensing as staff change, and periodically revisiting thresholds. When you want the adjacent layers — labeling, retention, eDiscovery depth — those are separate services in the same Purview family, and the configuration summary notes where each would attach.