Manage alert volume in insider risk management
Balancing alert volume is an important part of maintaining an efficient insider risk program. If your policies generate too few alerts, you might miss meaningful signals. If they generate too many, investigators might become overwhelmed, making it harder to focus on high-risk activity. Microsoft Purview Insider Risk Management includes several tools and settings to help you fine-tune alert volume and ensure your environment supports consistent, focused investigations.
When you’re receiving too few alerts
Receiving fewer alerts than expected might indicate that your policies are too narrow or that thresholds are set too high. To increase alert volume:
- Enable more risk indicators in the Policy indicators settings. This expands the types of activities that policies detect.
- Include more users in policy scope by editing the Users and groups section of the policy.
- Lower trigger thresholds to start evaluating users earlier based on specific events, such as resignation or access to sensitive content.
- Lower indicator thresholds to generate alerts based on less frequent or less severe activity.
- Adjust the alert volume slider under Settings > Intelligent detections. Moving the slider toward “More alerts” increases overall alert generation, including medium- and low-severity alerts.