Microsoft Purview Insider Risk Management Reviews

We are a cybersecurity consulting and implementation organization. We implement solutions to our customers for Microsoft Intune, Google Workspace, and other platforms. We also use Microsoft Intune with Business Premium internally.

We implement security and compliance tools including Microsoft Purview Information Protection, data exfiltration protection, DLP, Defender for Endpoint, and Sentinel.

For insider risk, we use Microsoft Purview Insider Risk Management for our UEBA because we deal with multiple customers and want to ensure data is secure and not exfiltrated or shared externally. We implement labeling first, then exfiltration protection, followed by insider risk management. We ensure customer data is not exfiltrated, even through corporate devices, as we don't allow BYOD devices.

Our customers primarily come with DLP and Information Protection use cases. The product is particularly effective for BFSI customers (banking and financial) because they require customizable policy creation beyond standard out-of-the-box policies. They focus on identifying data sources and destinations in transit, and also implement geolocation-based controls since most BFSIs operate regionally rather than globally. They require alerting mechanisms and correlation between logins and data transit, especially for suspicious activities from different locations.

We have been using the solution for four or five years.

The analytics functionality is useful, particularly during initial environment discovery phases, though it can sometimes produce results that aren't exactly accurate. While this makes policy fine-tuning challenging, the discovery capabilities are valuable.

We work with risk scoring, secure scores, and exposure scores within Microsoft. The scoring mechanism is exceptional because it eliminates the need to reinvent criteria for identifying risks, misconfigurations, or vulnerabilities. While not all products have similar functionality, Microsoft excels in this aspect.

The customizable alerts system needs improvement. The detection rules are not extensive enough. There should be more possibilities for creating alerts based on additional criteria. While rules can be customized, the available criteria for creating detection rules should be expanded.

Microsoft's pricing is very expensive. The Business Premium offering should be extended to enterprise customers, as it's currently limited to 300 users. There should be a tier below E5 that includes Microsoft Purview and other features. Currently, E5 licensing costs approximately 6,000 INR per user per month including taxes. Competitive solutions offer similar functionality at about 50% of Microsoft's cost.

Email DLP is included in Business Premium or P1 licenses, while P2 licenses cover endpoint DLP and additional channels. Microsoft should introduce an intermediate tier below E5 that covers all P1 licenses, as customers often need coverage across the entire M365 suite.

We have been using the solution for four or five years.

The solution is stable. We have experienced minimal downtime, with Microsoft resolving issues within five to ten minutes maximum. The RPO and RTO values are very limited.

Microsoft Purview Insider Risk Management is scalable and proves to be a good solution.

Support quality depends on the service tier. Premium support provides excellent service, but it can be challenging for customers who cannot afford it. Microsoft's direct expertise warrants a score of nine or ten. However, first-level support from third-party vendors such as Accenture or HCL typically scores between three to four.

Positive

I have worked with Titus and Fortra products for data classification and DLP. Fortra has acquired both Boldon James and Titus. Fortra performs effectively in data classification and DLP. They also offer UEBA functionality, though it is not as extensive as other solutions, but they are making improvements.

My main use cases involve identifying issues related to problems with the current software deployments and whether or not it is being utilized correctly.

I appreciate most of the dashboards and the notifications that are sent out with Microsoft Purview Insider Risk Management. I do not have to sit and watch it actively. I get notified.

An example of how these features from Microsoft Purview Insider Risk Management have benefited my organization is that we recently discovered a foreign actor. Someone from North Korea took a job at our company and was pretending to be an employee, and with Microsoft Purview Insider Risk Management, they notified us of that problem and we were able to remediate the fact that we had a North Korean spy working for us.

I feel Microsoft Purview Insider Risk Management can be improved by being able to identify patterns and practices of users to determine whether or not they fit the normal use case of a developer, an architect, and other roles. If your job role is a certain particular position, you should be able to use that to profile each job role to determine whether or not you are outside of your scope of what you are supposed to do and whether or not it is a risk.

I have been using Microsoft Purview Insider Risk Management for approximately a year.

I would assess the stability and reliability of Microsoft Purview Insider Risk Management as having improved, but it was not as good a year ago.

I believe Microsoft Purview Insider Risk Management scales well with the growing needs of the organization.

We do plan on expanding usage of Microsoft Purview Insider Risk Management, and I have a meeting with Microsoft to discuss expanding usage and other Purview product lines.

I would evaluate my customer service and technical support experience with Microsoft Purview Insider Risk Management as excellent.

Positive

Prior to adopting Microsoft Purview Insider Risk Management, I was not using another solution to address similar needs.

My experience with the deployment of Microsoft Purview Insider Risk Management was a fifty-fifty situation because we have a very diverse network, and not all of it is on Microsoft products. We have Apple and a variety of other different systems, so it was not as seamless as I would have preferred, but we accomplished it. With our partner and Microsoft's help, we were able to get there.

The deployment model for Microsoft Purview Insider Risk Management is hybrid.

I have seen a return on investment with Microsoft Purview Insider Risk Management. The one example that I provided was worth significant attention, as the FBI and other organizations became involved, so I am assuming it was really important.

My experience with the pricing, setup cost, and licensing related to Microsoft Purview Insider Risk Management is outside my area of responsibility. I do not deal with any of that.

I did not consider any other solutions before selecting Microsoft Purview Insider Risk Management, as I was more involved in the implementation and management rather than the decision-making process to purchase.

My advice to another organization that is considering using Microsoft Purview Insider Risk Management is to make sure they plan out their deployment very carefully because the biggest sticking point is deploying to the hybrid environment.

I would describe my experience with the usefulness of the contextual alert reviews and understanding the investigation of risk activities as useful. I gave this review a rating of eight.

The primary use case for Microsoft Purview Insider Risk Management was data loss prevention. This was my main objective.

Microsoft Purview Insider Risk Management was helpful in performing investigations after alerts were received. I was able to quickly identify the source of issues, which was valuable for data loss prevention. Additionally, it has saved us money on lawsuits and the loss of important confidential information that could lead to legal issues.

The reporting capabilities sometimes leave a little to be desired. It could be improved in terms of producing reports to provide information to the C-suite or others.

I worked more with it a couple of years ago, but right now I'm starting to look into it again.

I would rate the stability of Microsoft Purview Insider Risk Management as a nine. I almost never had issues with it.

I would rate the scalability of Microsoft Purview Insider Risk Management as an eight. The products are similar in their capabilities and how they present information. Additionally, the capability of creating policies to facilitate detections and responses improved.

When I had problems with Microsoft Purview or Defender, I would contact Microsoft. The experience varied depending on the support agent, and sometimes I had to wait a while. Overall, I had a few issues, so I would rate the service a nine for Purview.

Positive

I used a third party during the initial setup, so the process was quite smooth. I would rate it a nine because of the third party used.

I maintained Microsoft Purview Insider Risk Management myself without much ongoing maintenance. Regular periodic reviews of policies were necessary to ensure they were still effective. I checked for updates from Microsoft that might affect us.

Purview saved us from potential lawsuits and the loss of confidential information, preventing legal issues.

I did not compare Purview's pricing with many other solutions, but I was okay with the pricing.

I would recommend Microsoft Purview Insider Risk Management to others. I would rate the overall solution as a nine.

Insider Risk Management is useful for cybersecurity. It can be used to protect against attacks or for attack simulations. Insider Risk Management is another approach to security because it's about improving your company's internal security posture. It involves gathering and analyzing data about your employees to ensure there is no insider risk on your field model or tenant. 

I work with a Microsoft partner company that serves enterprise clients. Clients are at risk from USB sticks and remote workers. Some people have privileged access to sensitive documents. With Insider Risk Management, you can track if someone attempts to copy a critical document to a USB stick, download something to their device, or send documents to their personal email accounts.

Most of our customers pay a high amount for Microsoft enterprise licenses—more than a million dollars annually — so they want to get the full benefits of their licenses. Insider Risk Management is an excellent product that improves their security posture from the perspective of insider risks. 

It can take a long time to see the results, and most of the time, they are not given dynamically. It can take one or two days, but customers are happy to see the results. In Insider Risk Management, you can see which user was responsible this activity. They also have some eDiscovery teams and are happy to give their team some tests. They can create some eDiscovery cases to investigate the free feature alerts and actions. However, this can take weeks or months. 

The solution provides insight into user activity in Microsoft 365 products, such as Teams, Outlook, One Drive, etc. For example, it gives you alerts if a user downloads a file to their device, attempts to change the sensitivity label for a document, or tries to upload something to a third-party solution like Salesforce. With this solution, you can see all activity related to filename changes, sharing, etc.

These insights are critical to a company's security because many attacks involve a hacker hijacking an employee's account to do something inside your company. This product creates more alerts for your security team. You can manage the alerts to reduce the noise because if you get dozens of alerts, it's hard to tell if something is dangerous or just normal activity. It takes time to create some useful policies.

You can integrate Insider Risk Management with Microsoft Sentinel so that the alerts from risk management appear in Sentinel's live dashboard. It improves our threat response. It's more of a useful feature rather than one that saves a lot of time. We're generating thousands of alerts on the dashboards, which take time to adapt and understand, but many customers already use Insider Risk Management in their Sentinel dashboards. I don't have any data for this, but integration with Sentinel dashboards can save one or two hours because customers usually have some filters configured in Sentinel, so it's easier to find what you're looking for. 

Insider Risk Management's graphing is highly specific and useful. You can see the last six months of data for the Microsoft tenant. You can easily find what you need. For example, you can filter for alerts about devices, emails, etc. 

You can use the solution's DLP management features to create DLP policies or sensitivity labels. This is an excellent feature because there is no guesswork. Customers can create labels for credit cards or some financial information based on their countries' data regulations and use those in e-commerce management. 

Implementing policies in the solution isn't easy, and it takes time. For example, you need to use some secrets in Windows or Mac to execute your policies, and you can assign these policies with Microsoft Intune. However, when you execute a policy, you still need to wait up to two days to see alerts. Some of our customers aren't happy because they didn't expect it to take so long. They're satisfied once it starts working because they see the alerts and graphs. 

The user interface also isn't user-friendly. When we introduce Insider Risk Management to our clients, they often find it difficult to understand. There is too much information, and the UI is not scalable. Also, entry-level IT technicians are not always interested in learning something new. It should be clearer and easier to understand. 

Microsoft is still working on machine learning and AI components. They're constantly updating the product. However, from my experience, most of my customers are not ready or able to use the AI solution. They are creating some project plans and specific policies. They don't want to see dozens of alerts when they use Microsoft's recommendations or the AI-based solution. 

I have used Insider Risk Management for two years.

My customer says Insider Risk Management isn't stable. They have an internal IT team that manages devices with Intune and protects them by locking, upgrading, or downgrading the operating system. They also need to block access from other devices that are not company devices. From my experience, I don't think it will create an issue.

Insider Risk Management is scalable, but Microsoft needs to speed up its alert reaction time. Sometimes, it takes a while, and you don't know when you'll see the alerts, and it's hard to explain this to the customer. 

I rate Microsoft support three out of 10. The support team does not always have the most experienced people. I believe that Microsoft works with some third-party companies to provide support, and the technicians often don't know what they are doing.  They need to take time to research the issue and troubleshoot it within their internal teams. Sometimes, I resolve the issue on my own before the support replies with the answer. They aren't good at this product. It may be that the product is new and their support team still lacks expertise. 

Neutral

There are several deployment methods. For example, you can use the cloud version with Microsoft Intune. With Intune, you don't need to do anything. It is already enabled in the Microsoft 365 portal. There are some restrictions with the on-premises version because I can only deploy up to 10 gigabytes. This is not a useful solution because some want to use it on-premises. I am always using the cloud method. 

It's easy to implement Insider Risk Management within Intune. When Defender for Endpoint is enabled on your company devices, you can add all the devices to the Internet portal easily. However, this is also a problem for some customers because Defender for Endpoint may slow some devices. 

You can deploy quickly if your devices are already in Intune. If devices are not in the Intune, it can take two weeks to a month. It depends on your migration team. If all your devices are already in Intune, enabling it and extending the endpoint policy to the old devices takes two days at most. You might be able to complete it in two hours for a small environment, and you can set it up in two days for 1,000 devices if all of them are in Intune. 

The number of people required to deploy Insider Risk Management depends on the size of your environment and expertise. I can deploy 500 to a thousand by myself, but you need a clear project plan. It will take much longer without one. One person can do this migration, but you may need two or three people. The solution isn't difficult to maintain. You need to check the alerts and manage the devices and policies. 

If customers invest in Insider Risk Management, their companies will realize value. The security ROI is easy to explain because leaked confidential data will always damage your company, and it isn't easy to regain your customers' trust. 

For example, if you are a car company with some designs or images of a new car, people with privileged access to these files can share them with a competitor company or sell the data. Insider Risk Management can detect this . 

I rate Microsoft Purview Insider Risk Management six out of 10. I've had trouble using the product, and the UI isn't user-friendly. I don't mind the difficulties, but Microsoft's technical team doesn't provide adequate support, and there isn't clear documentation for some of the issues. 

I recommend working with a Microsoft partner company. Without a Microsoft partner, it may not be as smooth. Microsoft already has a foundation for implementing Insider Risk Management and policies for the customer's environment. This is also related to the customer has already some licenses of more than one thousand, for example. Microsoft has these projects that you can deploy inside the solution for free or almost free. You can ask the Microsoft sales department to find a good Microsoft partner to implement this solution.

We use Purview mainly for our internal risk management. Our main objective was to classify and categorize the information and we use the data protection feature in Purview.

In the cyber security threat landscape, people were initially concerned about outside threats, but now most companies are trying to use Zero Trust. They consider insider threats as a major vector too because there could be a chance of a phishing attack or other vulnerabilities. A hacker could enter the environment within your own systems and create a data breach by connecting your service to the external world.

We use Purview for our Microsoft SharePoint and OneDrive. I work for a biotech lab and we have a field team in place that visits medical doctors and pharmaceutical companies. That team uploads reports to all these shared drives in the cloud. We need to make sure that whatever information they upload has a proper sensitivity label attached to it so that it's not available to everybody. For our company, confidentiality is an issue.

Because our people use Microsoft Office products globally, like Word and Excel, it's easy to classify not only the data that is in the system but even the other documents, like Microsoft Word and Excel files in different departments, whether it's finance or HR—all of our services. Purview has helped us in doing that.

And when it comes to internal risk management, it has been helpful because sometimes, when people leave the company, they take documents from the company which could be intellectual property. Or they could be uploading sensitive documents to SharePoint. Even though that is a private cloud, uploading sensitive documents to it is not allowed because there could be implications if there is a data breach or that kind of incident.

For example, we have already had a case that is being investigated by our internal auditing and security risk committee, wherein an employee was trying to upload some documents to a personal OneDrive account when he was about to leave the company. Fortunately, they were not sensitive documents and it's up to management now to decide how to move forward. That's the main benefit.

It has helped to reduce our time to action on insider threats, whether something is done on purpose or not. Most of the incidents are done accidentally, like when someone is leaving and is in their notice period and wants to transfer some documents that they think would be helpful for employment or other personal use. People try to download those documents and upload them to OneDrive, because nowadays most companies don't allow printing or USBs. Purview makes our life easier because alerts of that sort are integrated into our ticketing solution. We just need to sort those tickets and show them to the compliance and regulatory auditors so that they can see that this is how we classify data. And if there is any incident, we have logging and monitoring processes in place.

With Purview, it's easier to present things to the auditors, the external regulatory bodies, to show that we have risk management, as well as internal risk management processes, and how we manage them. Compliance and regulations keep changing and Purview has those policies in place and is updated regularly. We don't need to worry about it.

The solution has reduced the manual effort of looking for what kind of data is being taken from the organization. It gives you a list of files or folders that have been transferred. That kind of auditing becomes easy. Before having the solution in place, we would have to manually check by logging into a particular person's folder or going through his email, doing an audit, and seeing what kinds of documents had been shared. This is much easier. It removes all the manual effort. With one click of a button, it gives you the entire information. It saves human time. Also, when it's done manually, you don't know the accuracy level of the discovery of the kinds of documents being shared.

The amount of money saved would be a very high number. Nowadays, data classification and data privacy are at the top of the list when it comes to cyber security, breaches, and data leakage. Now, if we need to resolve an incident, we already have the process in place. We don't need to reinvent the wheel. We can follow the workflow and get the things sorted out pretty quickly.

Another benefit of DLP is that not every individual understands cyber security and what kinds of data, whether it's a PII or PHI, or PCI is sensitive. There are occasions when they unintentionally send out this information but it could still cause a problem.

In addition, with Purview, we are able to view compliance in real-time. In my organization, we are using SOX, but even if you use SOC 2 or ISO, data governance is a part of it. That part is easily covered by using Purview. Tomorrow, for instance, if I have to present evidence for an audit, I can easily show the activities I have performed using Purview. The reports can be presented to the external auditor. That's true even for data classification and for data privacy purposes, like GDPR. It makes life much easier.

The best thing about Purview is that it's easy to integrate with our day-to-day environment. We have Active Directory, Word, and Excel. Using a third-party vendor and trying to integrate with our existing environment would be much more challenging.

There are predefined categories, and policies, that are created and they make implementation easy. The roles are well-defined. If a certain incident or an event is created, how should it be forwarded? What would be the process of managing that incident? Everything has been pretty well defined.

Purview is a self-contained environment. With other tools I've used, there is a DLP solution in place or something like a Defender solution in place. They just show you the log. But with Purview, there is a ticketing system, making it an independent environment. For example, if there is an incident tomorrow, you can create rules to create a ticket and automatically assign it to the help desk so that they can work on it. There is a workflow already in the picture, so you don't need a separate ticketing system if you don't have one. And you can always integrate it with your main ticketing system.

One of the features we have used is the connectors to interface with Workday, which is our HR tool. Whenever a person is in a probation period, when he is going to leave the company, it automatically starts monitoring any information being carried out from the company for his private use or in his future employment. We have configured those rules and it makes our lives easier because we don't need to ask HR or finance for a list of people who are going to leave the company at a particular point in time. The connectors do that entire work seamlessly.

For certain things, you need to install an agent. I understand it's for integrity, but if there could be a clientless solution for certain aspects, it would make life easier.

For example, you need to install a Microsoft agent on your endpoints for certain features to work for insider risk management. In the future, if they could enhance the technology to make it a seamless solution, that would be helpful, like the endpoint EDR solutions we have these days. Installing an agent on the client workstation is a headache. Whenever a new client comes in, you need to install an agent on it. It's an added task for IT. If they could eliminate that by integrating with AD or some other solution, that would make life easier.

It becomes an issue because sometimes people are working from home. They're using their own laptops or workstations and it becomes a problem because you cannot install the agents on their home laptops.

We have been using Microsoft Purview for seven to eight months.

Having one solution is important. Microsoft is in place for the entire organization, so using a Microsoft solution makes life easier in terms of stability. If you use a third-party vendor and there is a system upgrade or an architecture change in the software itself, then interoperability and stability become issues. This is the best solution on that front.

In terms of scalability, it has the features we are looking for and we are pretty happy with it. We are getting the required results. We don't need to do anything manually. It is all automated, and the processes are already in place in the solution itself.

We use Purview in multiple departments as well as multiple locations. We have our headquarters in the U.S., but we have another office in London. We provide global IT support. On average, it covers 1,300 to 1,500 endpoints.

We have not had to escalate major issues. In the seven to eight months we have been using it, we have not explored all the functions, only a limited part of it. But for whatever requests we have made to their technical team, we have received proper answers and solutions. In the future, if we need assistance, we would definitely get in contact with Microsoft support.

Positive

The deployment was simple because it already has different policies in it. But we need to have our own baseline for our company. Before this was implemented, we didn't have a solution to tell us how many files had been uploaded to OneDrive or shared through email. After a month or so, we got our own baseline and we were able to tune the policies. It was easy.

We were the ones who did the data categorization, classification, and implementation of the policies and workflows. For example, if there is an incident, who would be looking at the logs and how would it be escalated? We did the entire workflow.

Our deployment plan included integration with our other software applications and deployment of agents on the workstations. 

It doesn't require any maintenance because it's already integrated with Microsoft Azure and your Office 365.

For us, the return on investment is the elimination of manual labor, and the reduced amount of time spent looking for data leakage issues if there is an incident. 

And from the compliance perspective, we can download the reports from Purview and present them.

I worked in an organization that had a different DLP solution but they didn't have a dedicated internal risk management solution like Purview. They needed to use different kinds of solutions, from different vendors, to incorporate everything, and that creates overhead for day-to-day operations. It's a challenge because interoperability is an issue for different systems. Instead of having multiple vendors' solutions, I can install Purview, or I can enhance the features in Purview to make my life easier, and it can be managed through a single portal.

There are organizations that use multiple solutions to achieve different goals for data privacy, data governance, and data security. Instead of doing that, you can use Microsoft Purview. And Purview is easier to implement because most companies already have Microsoft Azure or AD Connect in the picture.

If you have different vendors, the pricing is a problem because you need to incorporate everything together. That's why Microsoft Purview is a perfect solution for us.

Whenever you go for any risk management solution, you need to understand the criticality and sensitivity of your organization when it comes to risk. Once you have done that, I would prefer Purview because it is an easy, out-of-the-box solution. It has predefined features. If a person has a basic understanding of IT security and information security, he can easily tweak those policies after a month or whatever time frame the company chooses and it works seamlessly.

We use Office 365 as well as Microsoft Defender and other Microsoft services for other purposes, like risky sign-ins or email forwarding. For example, if somebody is trying to forward their entire email box to a private email, that is something that is not permitted by our company's policies. We use different tools for different purposes. We use Purview more for data classification, categorization, and internal risk management. We use AI and automation for risky logins and risky sign-ins but not in Purview for internal risk purposes. 

We have defined policies for PII, things like passport or social security numbers, et cetera. The policy covers seven or eight types of PII information and would generate a high alert on this type of information.