A Microsoft Purview connector that loads human resources information from CSV files into Insider Risk Management. Resignation and leaving dates, changes in job level, performance reviews and improvement plans can then act as triggers or indicators.
Also called Microsoft 365 HR data connector.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains HR connector in context, with comparison tables and the common traps.
Terms in this definition
- Microsoft Purview
Family of Microsoft products for data governance, security and compliance. Its Data Map stores only metadata, such as lineage, schema and classification, never the data itself.
- HR
Human resources; in identity terms, the system, for example Workday, that acts as the source for inbound provisioning.
- Cluster Shared Volumes
Shared failover cluster storage that all nodes write to simultaneously, typically for Scale-Out File Server or Hyper-V. On SAN-backed storage, ReFS-formatted volumes work in redirected mode.
- Insider Risk Management
A Microsoft Purview solution that scores risky user activity, such as leaking or stealing data, from activity indicators and raises alerts. DLP policies are not edited here.
- Job
A sequence of steps executed together on one agent or runner, or on the server for agentless work. While running, each occupies one of your parallel jobs.
- Performance
Routing method in Traffic Manager that directs users to whichever endpoint offers the lowest latency.
Related terms
- Data Connector Admin
The Purview role required on the Data connectors page to set up connectors, for example the HR connector that Insider Risk Management relies on.
- Data theft by departing users
An insider risk template aimed at people leaving the organisation: it scores downloads, printing, copying to personal cloud storage and similar exfiltration near their leaving date, taken from the HR connector or the deletion of their Entra account.
- Physical badging connector
Feeds physical access events from a badge system, as JSON, into Insider Risk Management. Paired with priority physical assets, these become indicators of physical access; without an HR connector configured, only unauthorised entries are handled.
- Triggering event
Brings a user into an Insider Risk Management policy so scoring of their activity begins. Examples are a high-severity DLP alert or a resignation date from the HR connector.