Insider Risk Management - test policy not alerting

Question

I have configured an IRM policy using the settings listed below. I keyed on a label called SSNRAW-label. Per testing, I apply the label to word documents, attach the file and send the email to external domains. It has been over 24 hours and still no alerts are generated:

Any suggestions would be appreciated!

Answer 1

Hi @jpcapone

Greetings & Welcome to the Microsoft Q&A forum! Thank you for sharing your query.

According to this documentation: Create and manage insider risk management policies

Here are some troubleshooting steps from the image that might help resolve the issue.

There are six role groups used to configure insider risk management features. To make Insider risk management available as a menu option in Microsoft Purview and to continue with these configuration steps, you must be assigned to one of the following roles or role groups:

• Microsoft Entra ID Global Administrator role
• Microsoft Entra ID Compliance Administrator role
• Microsoft Purview Organization Management role group
• Microsoft Purview Compliance Administrator role group
• Insider Risk Management role group
• Insider Risk Management Admins role group

For more details refer: https://learn.microsoft.com/en-us/purview/insider-risk-management-configure?tabs=purview-portal#step-1-required-enable-permissions-for-insider-risk-management

Create and manage insider risk management policies

Learn about insider risk management

Hope this helps. Do let us know if you any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.