Forensic evidence is an opt-in add-on feature in Microsoft Purview Insider Risk Management that gives security teams visual insights into potential insider data security incidents, with customizable event triggers and built-in user privacy protection controls. Organizations can purchase the add-on in units of 100GB per month.
Opt-in add-on for Microsoft Purview Insider Risk Management
100GB per month capacity
1-year commitment with annual payment
NCE (New Commerce Experience) licensing model
Capacity resets monthly on the first of the month
Includes customizable event triggers and user privacy controls
Supports Windows 10 and Windows 11 devices
Includes Microsoft Purview Client for device activity capture
