Microsoft Purview | Insider Risk Management - Personal email triggers
From Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.Rollout
- Roadmap
- 496149
Rollout dates are often only in the text. When Microsoft moves them, the change shows under "What changed".
Schedule dates changed in the text
Date phrases in schedule sentences differ between the versions this installation saw- Seen 9 Sep 2025
early September 2025, late September 2025→ early December 2025, late December 2025
Read from date phrases in Microsoft's text, not from notice metadata. A changed phrase can be a moved rollout, a new milestone or just rewording; "What changed" below shows which.
What the notice says
Microsoft’s text, safely structuredUpdated September 9, 2025: We have updated the timeline. Thank you for your patience.
Introduction
To enhance detection capabilities in Insider Risk Management (IRM), we’re adding two new email indicators as triggers for data exfiltration activities. These indicators help identify potential data leaks when users send business-sensitive attachments to personal or public email domains. This update supports stronger data protection and aligns with customer feedback requesting broader coverage of email-based risks.
This message is associated with Microsoft 365 Roadmap ID 496149.
When this will happen
General Availability (Worldwide, GCC, GCC High, GCC DoD): Rollout will begin in early December 2025 (previously early September) and is expected to complete by late December 2025 (previously late September).
How this affects your organization
- Who is affected: Admins managing Insider Risk Management policies.
- What will happen:
- Two new email triggers will be available:
- Sending email with attachments to free public domains.
- Sending email with attachments to self (personal email).
- These indicators can be enabled from the IRM settings page.
- Sequence detections will now include these indicators as exfiltration activities.
- IRM quick policy templates will be updated:
- Email exfiltration: These two indicators will be set as default triggers and indicators. Sending email with attachments to external recipients will not be enabled by default.
- Data leaks: Both indicators will be added to triggers and indicators, with no changes to existing ones.
- Data theft by users leaving your org: Indicators will be added; existing triggers and indicators remain unchanged.
- Critical asset protection: Both indicators will be added to triggers and indicators, with no changes to existing ones.
- Existing policies created from quick templates will not be affected.
- Two new email triggers will be available:
What you can do to prepare
- No action is required. The new triggers will automatically become available for configuration in the IRM policy wizard.
Compliance considerations
No compliance considerations identified, review as appropriate for your organization.
What changed
Between archive captures, newest firstOnly details this page does not show changed.
- Tags
New feature, Admin impact→ Updated message, New feature, Admin impact
Updated September 9, 2025: We have updated the timeline. Thank you for your patience. Introduction To enhance detection capabilities in Insider Risk Management (IRM), we’re adding … Availability (Worldwide, GCC, GCC High, GCC DoD): Rollout will begin in early
SeptemberDecember 2025 (previously early September) and is expected to complete by lateSeptember 2025.December 2025 (previously late September). How this affects your organization:Who is affected: Admins managing Insider Risk Management …- Tags
- · first version seen
Learn more
Links from the notice and their documentation checksRelated public evidence
No related evidence found in this installation's recent collection. This does not establish that no announcement exists.
Not confirmed here
What this page cannot tell you- Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.