Insider Risk Management Policy No Users in Scope

Question

I created an insider risk management policy for testing purposes and scoped it to a group:

When viewing the policy in the Policies panel it shows no users in scope:

You can see that the policy was created 1/23/2025. The group is populated with two users. Any ideas?

Answer 1

Hi @jpcapone

Greetings & Welcome to the Microsoft Q&A forum! Thank you for sharing your query.

According to this documentation: Create and manage insider risk management policies

It may take several hours for manually added users to appear in the Users dashboard. Activities for the previous 90 days for these users may take up to 24 hours to display. To view activities for manually added users, go to the Users tab, select the user on the Users dashboard, and then open the User activity tab on the details pane.

But the policy was created 1/23/2025. Here are the few things you might consider resolving the issue:

Scope of the Policy - Ensure that the policy is correctly scoped to the specific group that contains the users. If the policy is scoped by one or more administrative units, you can only see users that you've been scoped for.

User Visibility - Verify that the users in the group are visible to you based on your permissions. If you are not assigned to the appropriate administrative units, you may not see the users.

Policy Configuration - Check that the policy has been configured correctly to include users. If no users or groups are assigned to the policy, you will need to edit the policy to select the appropriate users or groups.

Group Membership - Confirm that the users are indeed members of the group you scoped the policy to. Sometimes, changes in group membership may not reflect immediately.

Policy Health - Review the policy health to see if there are any indicators or triggering events that have not been configured, which might affect user scoring.

Is it possible that that a Office 365 group just doesn't work with as the scope for IRM policies?

It is possible that an Office 365 group does not work as the scope for Azure Information Rights Management (IRM) policies. Specifically, dynamic distribution groups cannot be used for IRM-protected messages, and it is recommended to use a distribution group instead. This indicates that not all group types, including certain configurations of Office 365 groups, may be compatible with IRM policies.

For more details refer: Create and manage insider risk management policies

Get started with insider risk management

Can't view Microsoft 365 IRM-encrypted message for dynamic distribution group

Preparing users and groups for Azure Information Protection

Hope this helps. Do let us know if you have any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.