MT.1174: Insider Risk Management policy for Risky AI usage is enabled.
| ID | MT.1174 |
| Severity | Medium |
| Suite | Mito |
| Product | Purview |
| Feature | Insider risk management |
| Security area | Logging and detection |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Framework controls | nist-800-53-r5:SI-4 System Monitoring |
| MITRE ATT&CK | T1213 |
| Reads from | Microsoft Graph, Security & Compliance PowerShell |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Ensure a Microsoft Purview Insider Risk Management policy from the Risky AI usage template is enabled so risky Microsoft 365 Copilot and AI-app interactions generate triageable alerts.
The Risky AI usage template detects:
- Prompts attempting to jailbreak or bypass system prompts.
- Prompts attempting to extract or summarise sensitive content that falls under DLP / SIT signals.
- Generation of harmful, unethical or otherwise risky AI responses.
- High-volume / anomalous AI-interaction patterns from individual users.
Without a Risky AI usage policy enabled, these signals are silently lost — Insider Risk reviewers will have no triage queue for AI misuse, and DSPM for AI cannot escalate risky users into Insider Risk Management workflows.
The test requires Microsoft 365 E5 or the Insider Risk Management add-on. The test will skip cleanly on tenants that do not license IRM (cmdlet Get-InsiderRiskPolicy is unavailable).
The test passes when at least one Insider Risk policy with an AI-related scenario / template is enabled.
Remediation action
Section titled “Remediation action”- Open the Microsoft Purview portal — Insider Risk Management — Policies.
- Click + Create policy.
- Choose the Risky AI usage template (under the AI / Generative AI category).
- Define users in scope (typically all users or a pilot group), reviewers, and any indicator thresholds.
- Enable the policy and confirm:
Get-InsiderRiskPolicy | Where-Object { $_.InsiderRiskScenario -match 'AI' -and $_.Enabled }.
Tip: Enable Adaptive Protection so that risky AI users automatically pick up stricter DLP / Conditional Access policies once they cross a risk threshold.
Related links
Section titled “Related links”- Microsoft Learn — Insider Risk Management policies
- Microsoft Learn — Detect risky use of AI with Insider Risk Management
- Microsoft Learn — Microsoft Purview AI Hub & DSPM for AI
Mito check. Author: OfirGavish. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.