Manage and take action on insider risk cases
Cases in Microsoft Purview Insider Risk Management allow investigators to track user risk over time, review associated alerts, and take action based on the severity and context of the activity. Each case focuses on a single user and can include one or more alerts. Cases are created manually when an alert requires deeper review or coordination with other teams.
Use the Cases dashboard to view all active and closed cases, assign ownership, and manage follow-up actions such as escalation, communication, and resolution.
Respond to alerts
Not all alerts require a case. You can take action directly from the Alerts queue by confirming or dismissing alerts as part of your triage process:
- Dismiss an alert if it’s a false positive or doesn’t require further review.
- Confirm an alert to indicate a policy violation and optionally create a case for deeper investigation.
Creating a case is recommended when an alert involves serious risk, multiple incidents, or needs collaboration across teams. Once a case is created, you can take further action such as sending notices, escalating, or resolving with a classification.