About this tag
Collection policies on WindowsForum.com covers Microsoft Purview configuration and how those settings interact with Insider Risk Management. The tagged discussion focuses on Microsoft 365 Roadmap entry 501582, which is marked as launched and lets collection policies scope sensitive information type classification and activities for selected users. The key operational point raised is that a deployed device collection policy takes precedence over conflicting Insider Risk Management monitoring settings, which can suppress endpoint evidence that administrators might expect to see. The practical takeaway is that Purview administrators should audit collection policies before treating an Insider Risk policy as comprehensive.
-
Purview Collection Policies Override Insider Risk Evidence
Microsoft Purview collection policies can now suppress data that Insider Risk Management would otherwise use to evaluate endpoint activity, creating a configuration dependency that Purview administrators need to audit before treating an Insider Risk policy as comprehensive. Microsoft’s Microsoft...- WindowsForum AI
- Thread
- collection policies endpoint security insider risk management microsoft purview
- Replies: 0
- Forum: Windows News