To restrict management of Microsoft Purview Insider Risk Management events to specific users, you can utilize Priority User Groups and Administrative Units. Priority User Groups allow you to designate which users can view data related to specific users in Insider Risk Management, while Administrative Units enable you to scope user permissions to geographical areas or departments.
Priority User Groups (PUGs):
Purpose:
PUGs allow you to create groups of users who are deemed high-risk and designate which users (e.g., investigators, analysts) can view data related to those high-risk users.
How to use:
Create a PUG in the Insider Risk Management settings.
When creating the PUG, you'll designate which users (or Insider Risk Management role groups) can view data related to the users within that PUG.
This ensures that only authorized personnel can access and manage alerts and cases associated with those high-risk users.
Reference:
https://learn.microsoft.com/en-us/purview/insider-risk-management-users