Insider Risk Management policies are enabled for risky AI usage
Overview
Section titled “Overview”Until organizations use Insider Risk Management with Adaptive Protection, they could fail to detect insider threats, risky behaviors such as misuse of legitimate access to exfiltrate data, or unsafe AI scenarios where users expose sensitive data to large language models or unauthorized cloud AI services.
Insider Risk Management works with Data Loss Prevention (DLP) to combine user behavior signals with content-based rules, helping teams detect risks early and respond before sensitive data is exposed or compromised.
Remediation
Section titled “Remediation”- Create and configure Insider Risk Management policies
- Help dynamically mitigate risks with Adaptive Protection
Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | Data, AI |
| Category | Data Security Posture Management |
| Product | Purview |
| Feature | Insider risk management |
| Area | Logging and detection |
| ATT&CK | T1213 Data from Information Repositories |
| Licence | EXCHANGE_S_ENTERPRISE |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.