Share via

Enable Microsoft Teams for collaborating on Insider Risk Management cases

Important

Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies to manage security and compliance. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.

Compliance analysts and investigators can use Microsoft Teams to collaborate on Microsoft Purview Insider Risk Management cases. They can communicate with other stakeholders on Teams to:

  • Coordinate and review response activities for cases in private Teams channels
  • Securely share and store files and evidence related to individual cases
  • Detect and review response activities by analysts and investigators

When you enable Teams for Insider Risk Management, the solution creates a dedicated team every time you confirm an alert and create a case. By default, the team automatically includes all members of the Insider Risk Management, Insider Risk Management Analysts, and Insider Risk Management Investigators role groups (up to 100 initial users). You can add additional organization contributors to the team after it's created and as appropriate.

For existing cases created before enabling Teams, analysts and investigators can choose to create a new team when working on a case, if needed. When you resolve the associated case in Insider Risk Management, the solution automatically archives the team (moves to hidden and read-only).

Learn more: Overview of teams and channels in Microsoft Teams.

Enable Teams support

  1. Sign in to the Microsoft Purview portal with credentials for an admin account in your Microsoft 365 organization.
  2. Select Settings in the upper-right corner of the page.
  3. Select Insider Risk Management to go to the Insider Risk Management settings.
  4. Select Microsoft Teams (preview).
  5. Turn the setting on.
  6. Select Save.

Create a team for existing cases

If you enable Teams support for Insider Risk Management after you have existing cases, you need to manually create a team for each case, as needed. Users need permission to create Microsoft 365 Groups in your organization to create a team from a case. For more information about managing permissions for Microsoft 365 Groups, see Manage who can create Microsoft 365 Groups.

Note

After enabling Teams support in Insider Risk Management settings, when you create a new case, the system automatically creates a new team.

  1. Sign in to the Microsoft Purview portal with credentials for an admin account in your Microsoft 365 organization.
  2. Go to the Insider Risk Management solution.
  3. Select Cases in the left navigation, then select an existing case.
  4. On the case action menu, select Create Microsoft Team.
  5. In the Team name field, enter a name for the new Microsoft Teams team.
  6. Select Create Microsoft team, then select Close.

Depending on the number of users assigned to Insider Risk Management role groups, it might take 15 minutes for all investigators and analysts to be added to the team.