In many of the environments I review, data theft by departing employees is either underestimated or only taken seriously after something has already gone wrong. Most organisations don't realise how exposed they are in the last days before someone leaves, at least not until the right controls and clear processes are in place. Implemented with care, Microsoft Purview Insider Risk Management gives you a practical, integrated way to deal with this risk on both the technical and the organisational side. In my experience, the built-in policy template "Data theft by departing users" is one of the most useful starting points for real protection. Even so, far too many tenants still don't treat it as part of their standard setup.

Insider Risk Management requires E5 licensing and onboarded data sources

Before you start with Insider Risk Management, get the prerequisites sorted. The full feature set needs Microsoft 365 E5, or the E5 Compliance/Insider Risk add-on licences. Without them, there is no meaningful way to deploy the solution. In practice, I also make sure SharePoint, OneDrive, Teams and Endpoint DLP (for local device and non-Microsoft cloud actions) are all onboarded as sources. If one is missing, you lose sight of entire categories of data movement. For exfiltration during offboarding in particular, you need visibility into both cloud and endpoint activity.

HR data connectors and Entra triggers give the policy a timely start

The "Data theft by departing users" template works best when it is closely tied to your HR platform. Ideally that means the official HR data connector (docs); at the very least, the exit date should be synced into Entra ID. Deleting or disabling a user in Entra ID can also trigger the policy, but by then it is often too late to catch the risky actions. Suspicious activity usually happens in the days or even hours before someone leaves. Typical examples are bulk downloads from SharePoint, whole folders copied to USB (if Endpoint DLP is deployed), or attempts to upload company data to personal cloud accounts from a managed device. The template lets you pick and prioritise these indicators so that they produce useful alerts instead of noise.

This is what the typical process looks like:

flowchart TD
    HR["HR Data Source"] --> Trigger["Departure Trigger"]
    Entra["Entra ID (Account removed/disabled)"] --> Trigger
    Trigger --> Policy["Insider Risk Policy"]
    Policy --> Indicators["Activity Indicators"]
    Indicators --> Case["Case Created"]
    Case --> Triage["Triage: HR, Legal, InfoSec"]

Figure: Typical flow of a departing user policy with HR data and Entra triggers.

The policy combines downloads, USB copies and cloud uploads as indicators

My strong advice is not to depend on a single indicator. The template brings several signals together: unusually high download volumes from SharePoint or OneDrive, copies to USB sticks (if Endpoint DLP is in place) and attempts to upload files to personal cloud storage. Keep in mind that device activity is only captured when the device is onboarded into Endpoint DLP. I've come across plenty of cases where that coverage had gaps, especially in hybrid or BYOD setups. Once it is configured properly, the policy can pick up aggregated risky behaviour, for example a user moving large sets of sensitive documents within a short period.

Pro tip: Most admins don't realise how far the Insider Risk Management thresholds for risky actions can be tuned. Run the pilot with deliberately lower thresholds to calibrate detection, but always tell HR and legal (and in Germany, your works council) beforehand.

Pseudonymisation and the works council shape the privacy setup

In Germany especially, privacy expectations are high, and you can't work around them. By default, Microsoft Purview pseudonymises user identities in Insider Risk cases. Security or compliance analysts only see anonymised IDs unless a case is "justified" and escalated properly with HR and legal involved. You can configure in detail who sees what and when an identity is revealed, and every access is audited. Getting the privacy and notification settings right matters a lot, and so does talking to your works council early. What has worked for me is genuine transparency and a phased, open approach; that wins over even works councils that are sceptical at first. Microsoft describes these capabilities in detail (Insider Risk Management).

HR, legal and security handle triage together

The triage workflow sits at the centre of the process. For each case you decide whether it needs immediate action, whether it is a false positive, or whether it needs a closer look. You need clear rules for escalation and for de-anonymising data, and HR and legal must always be part of that. Any access to personal data should be justified and documented precisely. In my projects, the approach that works best is to have HR confirm that there really is an offboarding event, and to get legal sign-off before any identity is revealed.

Adaptive Protection and DSPM extend the policy into AI scenarios

If you want to take it further, combine Insider Risk policies with Purview Adaptive Protection, for instance to tighten DLP rules automatically as a user's risk score goes up. I described this in Adaptive Protection: Risk-driven DLP and Access in Purview. Organisations using Microsoft 365 Copilot or other AI services should also look at Data Security Posture Management (DSPM). It is becoming more and more important for keeping data classification and access controls in step with the fast data movement in AI scenarios. My hands-on post DSPM for AI: Copilot and AI models under control covers this.

I rely on transparency and a careful, staged rollout

I don't see Insider Risk Management as just a security feature. It is just as much a compliance and HR tool. A smooth deployment depends on involving HR, legal and the works council (where relevant) early and honestly. Start with a pilot group, adjust the privacy and detection settings, and try out the escalation workflows in practice before you roll out to the rest of the business. That way you avoid most of the unpleasant surprises, and your departing users don't walk out with company data as a parting gift.