# Insider Risk Management policy for Risky AI usage is enabled

Ensure a Microsoft Purview Insider Risk Management policy from the Risky AI usage template is enabled so risky Microsoft 365 Copilot and AI-app…

Source: https://maester.dev/docs/tests/MT.1174

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/ofirgavish" title="Ofir Gavish · Original author"><img src="https://github.com/OfirGavish.png" alt="Ofir Gavish" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/ofirgavish">Ofir Gavish</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Purview · Insider risk management · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1174
```

## Overview

Ensure a Microsoft Purview Insider Risk Management policy from the **Risky AI usage** template is enabled so risky Microsoft 365 Copilot and AI-app interactions generate triageable alerts.

The Risky AI usage template detects:

- Prompts attempting to **jailbreak** or bypass system prompts.
- Prompts attempting to **extract or summarise sensitive content** that falls under DLP / SIT signals.
- Generation of **harmful, unethical or otherwise risky** AI responses.
- High-volume / anomalous AI-interaction patterns from individual users.

Without a Risky AI usage policy enabled, these signals are silently lost — Insider Risk reviewers will have no triage queue for AI misuse, and DSPM for AI cannot escalate risky users into Insider Risk Management workflows.

The test requires Microsoft 365 E5 or the Insider Risk Management add-on. The test will skip cleanly on tenants that do not license IRM (cmdlet `Get-InsiderRiskPolicy` is unavailable).

The test passes when at least one Insider Risk policy with an AI-related scenario / template is enabled.

#### Remediation action

1. Open the [Microsoft Purview portal — Insider Risk Management — Policies](https://purview.microsoft.com/insiderriskmgmt/policies).
2. Click **+ Create policy**.
3. Choose the **Risky AI usage** template (under the AI / Generative AI category).
4. Define users in scope (typically all users or a pilot group), reviewers, and any indicator thresholds.
5. **Enable** the policy and confirm: `Get-InsiderRiskPolicy | Where-Object { $_.InsiderRiskScenario -match 'AI' -and $_.Enabled }`.

> **Tip:** Enable Adaptive Protection so that risky AI users automatically pick up stricter DLP / Conditional Access policies once they cross a risk threshold.

#### Related links

- [Microsoft Learn — Insider Risk Management policies](https://learn.microsoft.com/purview/insider-risk-management-policies)
- [Microsoft Learn — Detect risky use of AI with Insider Risk Management](https://learn.microsoft.com/purview/insider-risk-management-policy-templates)
- [Microsoft Learn — Microsoft Purview AI Hub & DSPM for AI](https://learn.microsoft.com/purview/ai-microsoft-purview)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1174 |
| Severity | Medium |
| Suite | Maester |
| Product | Purview |
| Feature | Insider risk management |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1213 Data from Information Repositories |
| Supports controls | nist-800-53-r5:SI-4 |
| PowerShell test | [Test-MtPurviewAiInsiderRiskPolicy](https://github.com/maester365/maester/blob/main/tests/maester/purview/Test.MT.1174.ps1) |
| Services | Graph, SecurityCompliance |

</details>

## Source

- Test: [`tests/maester/purview/Test.MT.1174.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/purview/Test.MT.1174.ps1)
- Documentation: [`tests/maester/purview/Test.MT.1174.md`](https://github.com/maester365/maester/blob/main/tests/maester/purview/Test.MT.1174.md)