Records screen clips of security-relevant activity on onboarded devices running the Purview Client, as an optional add-on to Insider Risk Management that is off until enabled. Capturing requires two people to approve, via Insider Risk Management Approvers.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Forensic evidence in context, with comparison tables and the common traps.
Terms in this definition
- Insider Risk Management
A Microsoft Purview solution that scores risky user activity, such as leaking or stealing data, from activity indicators and raises alerts. DLP policies are not edited here.
- Insider Risk Management Approvers
A role group in Insider Risk Management, usually given to legal or HR staff, whose members accept or turn down requests to capture forensic evidence.
Related terms
- Insider Risk Management Investigators
A role group in Insider Risk Management for people who look into cases and alerts, with access to content explorer and forensic evidence captures. Members can also set up notice templates.