Collection Policy and Insider Risk Policy Conflicts

Matthew Silcox

03 Sep 2025 — 2 min read

*so you thought one Purview feature wouldn't interfere with another one...*

One of the lesser-known (and dare I say "quietly devastating") mechanics in Microsoft Purview Insider Risk Management (IRM) is how Collection Policies silently override your IRM policy logic.

They don't cooperate and they especially don't warn you.

*https://learn.microsoft.com/en-us/purview/collection-policies-solution-overview#collection-policies-and-microsoft-purview-insider-risk-management*

If there's a conflict, the Collection Policy wins.
IRM never even sees the event.

In Practice...

Let's say you configure an IRM policy to monitor file printing. Maybe you want to catch users printing sensitive documents. Sounds reasonable. But upstream, your Collection Policy is configured to filter out print events entirely.

What happens?

Nothing! The sensitive print event is never collected, and the IRM policy never sees it. If the Collection Policy doesn't collect it, IRM cannot process it, even if it's explicitly configured to.

Here's a simple table with a couple scenarios to help map it out:

Collection Policy Action	IRM Policy Action	What Actually Happens
Filters out an activity	Tries to monitor it	IRM sees nothing, and the Collection Policy blocks it
Collects an activity	Doesn't monitor it	IRM ignores it (no case is generated)

The hierarchy looks like this:

Device Activity → Collection Policy → IRM Policy → Alerts

Lab Scenario...

These things are usually better understood when you break them yourself. So, open up a Dev Tenant and try this:

Set up a Collection Policy that excludes file copy to USB.
Set up an IRM Policy that monitors file copy to USB.
On an onboarded Device, perform the triggering activity.
Note what happens.
1. (Hint: i bet it's nothing)

If anything, remember this...

If Collection Policies don't allow it, IRM can’t see it. If IRM doesn't monitor it, it sees it but throws it away.

This means you can easily configure a false sense of monitoring. This is especially true in orgs where policy teams and device data collection teams aren’t tightly aligned.

So, If you're wondering why your IRM alerts are so quiet lately...check your Collection Policies. They might disappoint you.

Using Microsoft’s Data Security Stack to Prevent the Next Breach

AI is transforming industries worldwide, but it’s simultaneously creating one of the largest data risks we've ever seen. According to the Varonis 2025 State of Data Security Report, 95% of healthcare organizations have exposed sensitive cloud data, and 64% have employees using unverified AI tools. The same

Email SIT Finder Update: All Credentials Bundled Entity

Found this nugget buried in the Purview Blueprints Github repo. Figured I'd take a crack at integrating credential SITs into my EXO SIT Finder. The "All Credentials" Bundled SIT is multitudinous and complex, as you can see in the linked Learn Doc below. Current SITs being

Architectural Case Study | Extending Microsoft Purview with Fortra (Digital Guardian) DLP via the MIP SDK

This post is a continuation of a series. See part 1, here. Most enterprises already live in dual worlds. On one side, Microsoft Purview governs information inside Microsoft 365. But on the other, dedicated DLP platforms like Digital Guardian DLP control endpoints, networks, and file movement. So what's

Uniting Purview and Third-Party Data Security Products

As a consultant in the Microsoft Security & Compliance space, you learn that some projects are more like therapy sessions. Half the organization wants to migrate to Microsoft, and the other half, clutching their Varonis or Symantec licenses, waits in the shadows for their "I told you so"