Microsoft Purview Insider Risk Management Features

Silently deploys on endpoints without alerting users.

Detects data movement to external USBs or external drives or uploaded to cloud storage or emails and excessive printer-usage.

Tracks activities taken on files or in applications, including save, print, or delete actions.

Sends alerts to administrators when users take insider threat actions .

Maintains active and historical evidence in a searchable format.

Provides risk scoring for suspicious activity.

Records video or screenshots of endpoint sessions.

Logs keystrokes of users.

Analyzes user writing patterns to determine sentiment changes to identify disgruntled workers.