Detect risky AI usage with Insider Risk Management

Description

A Microsoft Purview Insider Risk Management policy built from the Risky AI usage template is active and scoped to all users (or to the populations defined with the works council). It detects risky prompts and responses in Microsoft 365 Copilot and other AI apps, such as sensitive information in prompts, access to protected content through AI, and prompt injection attempts. Pseudonymization of users in alerts stays enabled.

Collecting AI interactions outside Microsoft 365 (third-party AI sites) needs device onboarding and the browser extension or network integration described by Microsoft.

Rationale

Generative AI creates new paths for data leakage that DLP rules on mail and files do not see. The Risky AI usage template correlates AI interactions with other insider risk indicators so the team can investigate patterns rather than single events.

Impact

Insider risk monitoring processes personal data about employees. In France, deploy it only after a data protection impact assessment, information of employees and consultation of the works council (CSE). Limit access to alerts to a small, named team.

Applies when

Requires: Microsoft Purview E5 Compliance

Audit

1. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as a member of the Insider Risk Management Analysts or Insider Risk Management Auditors role group (read-only roles for this solution).
2. Browse to Solutions > Insider Risk Management > Policies.
3. Check that a policy based on the Risky AI usage template exists, its status is active (not paused or in test), and its scope covers the intended users.
4. Browse to Insider Risk Management > Settings > Privacy and check that pseudonymized user names are shown.
5. Fail if no active Risky AI usage policy exists.

Remediation

1. Complete the data protection impact assessment and works council consultation.
2. Sign in to the Microsoft Purview portal as an Insider Risk Management Admin.
3. Configure Insider Risk Management > Settings (privacy, policy indicators for Microsoft 365 Copilot and AI apps).
4. Browse to Policies > Create policy, select the Risky AI usage template, set the users in scope, the indicators and thresholds, and create the policy.
5. Assign alert triage to the Insider Risk Management Investigators role group.

Rollback

Pause or delete the policy under Insider Risk Management > Policies.

References

• Insider risk management policy templates Microsoft, vendor-doc, accessed 2026-10-24
• Microsoft Purview data security and compliance protections for generative AI apps Microsoft, vendor-doc, accessed 2026-10-24
• Maester MT.1174 Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-DATA-004 Enforce a DLP policy for Microsoft 365 Copilot

People and lifecycle