MC1124562 - Microsoft Purview | Experience enhancements to IRM alert workflow
Service
Last Updated
Published Jul 30, 2025
Tag
Platforms
Summary
Microsoft Purview Insider Risk Management alert workflow is enhanced to improve usability by reducing clutter and maximizing visual space. Updates include default opening of Activity Explorer, relocated alert details and actions, and adjustable panels. Rollout begins September 2025, enabled by default for licensed tenants, with no admin action needed.
More information
Updated August 13, 2025: We have updated the content. Thank you for your patience.
Introduction
We’re enhancing the Insider Risk Management (IRM) alert investigation experience to streamline workflows and improve usability. These updates are designed to maximize visual space, reduce clutter, and make it easier for analysts and investigators to focus on key insights during alert investigations.
This message is associated with Microsoft 365 Roadmap ID 493754 for Worldwide.
When this will happen
- Public Preview (Worldwide): We will begin rolling out early September 2025 and expected to complete by late September 2025
How this will affect your organization
Prerequisite: To receive the updated IRM alert workflow experience, tenants must have an Insider Risk Management (IRM) license.
This feature is on by default for eligible tenants once rollout begins.
These updates will improve the alert investigation experience for Insider Risk Management analysts and investigators. While all existing functionality remains available, some features will appear in new locations. Key changes include:
- The Activity Explorer tab will now open by default when an alert is selected.
- The All Risk Factors tab has been enhanced to support more efficient investigations.
- The alert details banner previously shown at the top of each tab is now accessible via the Details button.
- Actions such as assigning users or taking action on an alert are now located under the Details button.
- The User Timeline, previously displayed to the left of the Activity Explorer, is now accessible via the Timeline button above Activity Explorer where the columns are managed.
- Users can now maximize or minimize the Activity Explorer panel for improved visibility.
These changes are designed to reduce visual clutter and improve focus during investigations.
Alert workflow enhancements before and after:
What you need to do to prepare
- Share this information with your Insider Risk Management analysts and investigators.
- Review the updated layout and functionality to ensure teams are familiar with the new locations of existing features.
- No admin action is required to enable these changes.
Compliance considerations
No compliance considerations identified, review as appropriate for your organization.