17.2 Configure Policy Indicators

Indicators are a three-layer model

Insider Risk Management does not score every interesting audit event by default. Microsoft splits the model into three layers you must keep straight on SC-401:

1. Triggering events — Decide whether a user becomes active in a policy at all. Add User A to a Data theft by departing users policy and configure the HR connector: until a termination date arrives, the policy does not evaluate User A. A High severity data loss prevention (DLP) alert is the analogous trigger for Data leaks policies.
2. Global settings indicators — The tenant catalog. Indicators you enable here define which signals IRM even collects and which indicators later policies may select. If someone copies files to USB and you enabled that indicator only globally, you can still see the activity in Activity explorer. If that user is not in a policy, IRM does not assign a risk score or generate an alert.
3. Policy indicators — The subset you attach to a specific policy. They assign a risk score only after a triggering event. Examples Microsoft lists: copying to personal cloud storage or portable devices, a user account removed from Microsoft Entra ID, and sharing internal files and folders with unauthorized external parties.

All global indicators are disabled by default. You must select one or more on Settings > Policy indicators before you can configure a policy. If the policy wizard's indicator page is grayed out, use Turn on indicators or return to this settings page. Indicators you enable globally become the available set; you still choose which of those apply to each policy.

Manually added users can take several hours to appear on the Users dashboard. Activities for the previous 90 days for those users can take up to 24 hours to display.

You can customize triggering events with selected indicators and sequences only for policies created from Data leaks or Data leaks by priority users. Microsoft states that policies created from all other templates do not have customizable triggering indicators or events.

Built-in indicator groups

Policy indicators sit on two tabs: Built-in indicators and Custom indicators. Custom indicators require an Insider Risk Indicators connector (preview) first. You then map a source column and either a numeric threshold column or Use only as a triggering event without any thresholds. Custom indicators attach to Data theft or Data leaks policies. Wait 24 hours after updating custom indicators and associated policies before uploading sample data so components can sync.

After cloud storage indicators are on, you can still turn off individual apps—for example score Box and Google Drive downloads but not Dropbox.

For Microsoft Copilot experiences and Enterprise AI apps, Choose apps to monitor lets you deselect apps to cut noise and pay-as-you-go cost. Selecting Azure AI Content Safety creates a Communication Compliance policy; editing that policy in Communication Compliance may incur pay-as-you-go billing.

DLP and device traps that cost exam points

The High Severity DLP Alert indicator currently evaluates alerts from DLP policies scoped to Exchange Online, SharePoint Online, and OneDrive for Business. Microsoft lists these workloads as not supported: Endpoint DLP, Microsoft Teams, Microsoft 365 Copilot, on-premises repositories, and Power BI. If a DLP policy spans Exchange plus Endpoint, only the supported-workload slice is processed. Endpoint, Teams, and Copilot DLP alerts are also not evaluated as Data leaks triggering events—the same supported-workload rule applies.

Device indicators process activity for onboarded Windows 10 Build 1809 or higher and the three latest macOS releases. Browser signal detection covers non-executable files viewed, copied, shared, or printed in Microsoft Edge and Google Chrome. If an IRM policy watches a device activity but a collection policy filters that activity out, the collection policy configuration takes precedence. The device activity is not collected and is not available for review in Insider Risk Management.

Risk score boosters

Boosters raise the score when:

• Activity is above the user's usual activity for that day
• The user had a previous case resolved as a policy violation
• The user is a member of a priority user group
• The user is a potential high impact user—more sensitive content than others, Entra hierarchy level, number of users reporting to them, or membership in a Microsoft Entra built-in role with elevated permissions

Enabling the high-impact booster shares Microsoft Entra data with the Purview portal. If the tenant lacks sensitivity labels or has not configured organization hierarchy in Entra ID, detection may be less accurate. A user who is both a priority-group member and a potential high-impact user is boosted only once.

Peer groups for cumulative exfiltration use organization hierarchy, access to shared SharePoint resources, and job titles in Microsoft Entra ID. If the tenant does not maintain that information in Entra ID, detection may be less accurate.

Thresholds, analytics recommendations, and variants

When you later walk the policy wizard (next chapter), each enabled indicator can use three daily-event bands. Microsoft's SharePoint example: 10 or more events per day for lower impact, 20 or more for medium impact, 30 or more for higher impact. 1–9 SharePoint events after a trigger tend not to generate an alert. You can instead choose Activity is above user's usual activity for the day if that option is enabled under Policy indicators. If the option is listed but not selectable, enable it on Settings > Policy indicators.

With Analytics on, the wizard can Apply thresholds specific to your users' activity using the previous 10 days. A gauge estimates how many scoped users exceeded the lowest daily thresholds for at least one selected built-in indicator. Microsoft does not provide recommended thresholds for custom indicators or variants. Insights can take 24 to 48 hours after analytics is enabled. The View impact graph is unavailable if the policy uses Include specific users; you must use Include all users and groups.

Indicator variants (preview) tailor a built-in indicator with detection groups (capture everything except exclusions, or capture only inclusions). Limits Microsoft publishes: up to ten variants per built-in indicator, 100 variants across all indicators, and up to five detection groups of a single type per variant. Some indicators (for example Microsoft Defender for Endpoint indicators) do not support variants. Variants do not support sequences, cumulative exfiltration activities, the risk score booster, or real-time analytics for the detections-group preview.

Scoping priority Microsoft documents:

1. Global exclusions
2. Variant inclusion or exclusion
3. Priority content

Exam traps for indicators

• Disabled by default. A policy with no selected indicators never scores.
• Trigger is not an indicator. Triggers admit the user; indicators score the user.
• Activity explorer is not an alert. Global-only signals without a policy produce explorer rows, not cases.
• Entra ID Protection in IRM is ConfirmedCompromised or Remediated only—not every risky sign-in.
• High-severity DLP on unsupported workloads is a silent no-op for the DLP indicator.
• A collection policy overrides device indicators when they disagree.