19.2 Insider Risk Workflow and Notice Templates

Creating the case is not the end of an Insider Risk Management program. Microsoft describes a five-stage workflow: Policies → Alerts → Triage → Investigate → Action. The previous section covered alerts, triage, and investigation tools. This section covers the Action stage and the reusable notice templates that keep user notification consistent, auditable, and role-correct. SC-401's wording is explicit: manage the IRM workflow, including notice templates.

The published IRM workflow

Policies (templates, indicators, in-scope users, and detection windows) produce alerts when indicators match. Triage decides whether to confirm into a case, dismiss as benign, or leave the item in Needs review. Investigate happens in the case: User activity, Activity explorer, Content explorer, forensic captures, and notes. Action is what you do when the picture is clear enough: send the user a notice, resolve the case, share it (email, ServiceNow, Teams, or Power Automate), or escalate it into eDiscovery (Premium).

The Users dashboard sits between policy assignment and cases. Investigators use it to see who is in scope, stop scoring activity, and (with the right flows) notify someone that they were added to a policy. Removing a user from in-scope status can take several minutes. If that user still has active alerts or cases, they remain on the dashboard and the user details show they are no longer in-scope for a policy.

Notice templates: purpose and limits

Most confirmed alerts are mistakes, not malice. Microsoft's published guidance is to treat notices as reminders, links to refresher training, or pointers to corporate policy—not as a substitute for HR or legal process. Notices also create a documented trail when the same user repeats the behavior.

You create templates under Insider Risk Management > Notification templates. The dashboard lists templates in reverse date order (newest first). Configure notice templates is allowed for Insider Risk Management, Insider Risk Management Analysts, and Insider Risk Management Investigators. Admins cannot configure notice templates; they configure policies and settings instead. That pairing is an exam discriminator: the people who investigate are the people who own the wording of the email the user will see.

Each template has four fields:

• Template name — shown on the template list and in the picker when you send from a case
• Send from — mailbox that appears in From, unless you change it at send time
• Subject — text for the message subject line
• Message body — text or HTML

You may send a notice only to the user email address associated with that case. You cannot redirect a case notice to a manager, an HR mailbox, or a distribution list from the notice-template action. Manager or HR notification is a different path (recommended Power Automate flows).

HTML is supported, with one published catch: href attributes must use single quotes, not double quotes. A training link written as href="https://contoso.com" can fail in this template surface; href='https://contoso.com' is the documented pattern.

When you send from a case, choosing a template pre-fills the other fields. Anything you type in the send dialog overrides the template for that send only; it does not rewrite the stored template. All sent notices are added to the Case notes queue. Edit a stored template from the template details page (Edit), and delete unused templates with the toolbar delete icon after a Yes confirmation.

Sending a notice does not close the case

On the case action toolbar, Send email notice is independent of Resolve case. Microsoft states explicitly that sending a notice does not set the case to Closed. Leave the case Active if you want to keep watching the user without opening a second case. If the coaching email is the last step, send the notice, then Resolve case as a follow-on action.

Resolve as one of two published classifications:

• Benign — policy-match alerts evaluated as low risk, not serious, or false positive
• Confirmed policy violation — policy-match alerts evaluated as risky, serious, or the result of malicious intent

Resolving sets status to Closed, writes the classification and your Action taken text into case notes, and starts the 120-day resolved-case retention clock. Optionally you can delete the case and associated content immediately; that permanently removes related content, alerts, and insights. Use immediate delete only when policy requires destruction, not as a default click. If Microsoft Teams integration is enabled, resolving also archives the case team (hides it and makes it read-only).

Do not invent extra IRM case-resolution labels such as True positive or False positive. Those are Microsoft Defender alert classifications. Defender maps them into IRM Confirmed or Dismissed when alerts sync; they are not the Resolve case dropdown values.

Escalate, share, and automate

Escalate for investigation creates a Microsoft Purview eDiscovery (Premium) (shown as eDiscovery > Advanced) user investigation so legal can preserve, collect, review, analyze, export, and run legal-hold notifications. You name the new investigation, add notes, and can adjust notice fields (those values override the template). After Confirm, open the new case in eDiscovery Advanced. Escalation is for extra legal review, not a synonym for "confirm the IRM alert" and not the same thing as opening a Defender XDR incident.

If Teams integration is on in IRM settings, confirming an alert and creating a case automatically creates a Microsoft Teams team. Use View Microsoft Teams team on the case toolbar. Cases opened before you enabled integration get Create Microsoft Teams team instead.

Recommended Power Automate templates (included with IRM licensing for those templates; premium or custom connectors may need extra Power Automate licenses) cover: notify users when they are added to a policy (Users dashboard); request information from HR or business (responses land as case notes); notify the manager of an alert (policy, date/time, severity, also logged to case notes); and create a ServiceNow record. Flows must be created in the default Power Automate environment. If you anonymize users in IRM privacy settings, the user- and manager-notification templates do not function as intended. Only the flow creator can run a flow until it is shared. Creating or sharing from IRM settings requires Insider Risk Management or Admins; from Manage Power Automate flows on a case, membership in at least one IRM role group is enough.

Contributors and who can resolve versus investigate

The Contributors tab grants temporary access to a specific case. You need the Role Management role to add contributors. By default, Insider Risk Management and Investigators appear as contributors on every active and closed case. Analysts and investigators can add contributors; you cannot add analysts as contributors; contributors cannot add other contributors. Contributors get case-management controls except permission to confirm or dismiss alerts and permission to edit contributors.

Who investigates versus who configures remains the backbone of the workflow:

Analysts and Investigators (and the umbrella Insider Risk Management group) complete review and then Resolve case. Admins do not resolve cases because they cannot open them. Keep at least one user in Insider Risk Management or Admins so the tenant does not reach a zero-administrator state. Role assignment can take up to 30 minutes to apply across the organization.

A practical sequence for the exam

A typical inadvertent-exfiltration path: High-severity Needs review alert → Investigator confirms and creates a case → User activity shows a sequence (for example download, then USB) → Content explorer snapshot (often about an hour for new cases) → Send email notice from a training template (override the subject if needed; HTML links use single quotes) → leave the case Active overnight → if no further spikes, Resolve as Benign with Action taken notes. A typical theft path uses the same triage, then Escalate for investigation so eDiscovery can place holds, and resolve the IRM case as Confirmed policy violation only after that handoff is recorded in notes.

If the exam stem asks who can "manage the workflow including notice templates," pick Investigators or Analysts (or the umbrella group)—not Admins, not Auditors, and not Approvers. If it asks whether the coaching email closes the investigation, the answer is no: Resolve case is the close action, and resolved artifacts follow the published 120-day clock unless you chose immediate delete.