Insider Risk Management Forensic Evidence

Microsoft Purview Insider Risk Management – Forensic Evidence
Forensic Evidence is an opt-in add-on for Microsoft Purview Insider Risk Management that equips security teams with richer visual context for potential insider data security incidents. When enabled, it securely captures privacy-preserving screenshots and activity snapshots tied to policy alerts, helping analysts understand user actions, timelines, and intent while maintaining built-in privacy controls and role-based access. This add-on streamlines investigations, reduces time to triage, and strengthens evidence quality for remediation or escalation. Forensic Evidence integrates with existing Insider Risk signals and policies, adheres to Microsoft’s compliance and auditing standards, and supports least-privilege workflows. Add this capability to enhance visibility, bolster case documentation, and make informed, defensible decisions across your insider risk program.
Source: Microsoft Purview Insider Risk Management documentation