Updated November 14, 2025: We have updated the content. Thank you for your patience.
Microsoft Purview Insider Risk Management (IRM) has reached General Availability for the Security Copilot alert triage agent. The agent helps analysts focus on the most urgent alerts by analyzing and prioritizing Insider Risk Management alerts. It also provides a summary of findings to help users quickly understand the risky activities that make an alert critical to review.
With this release, users can report miscategorized alerts and provide feedback on prioritization. Feedback is sent directly to Microsoft but is not used for agent memory.
We will temporarily disable the ability to add new custom instructions in IRM alert triage agent. Existing instructions will not be honored during this period. This feature will return in 2026. Additionally, the file risk section of the agent summary has been deprecated.
This message is associated with Microsoft 365 Roadmap ID 503764.
When this will happen:
General Availability (Worldwide): Rollout begins in late November 2025 and is expected to complete by mid-December 2025.
How this affects your organization:
- Who is affected: Organizations using Microsoft Purview Insider Risk Management.
- What will happen:
- The alert triage agent will be available by default; no action is required to enable it.
- Users will be able to submit feedback on alert prioritization directly to Microsoft.
- The file risk section in the agent summary will be deprecated.
- No changes to existing admin policies are required.
What you can do to prepare:
No action is requiredThe Microsoft Purview Triage Agents run on Security Compute Units (SCU). Your organization must have SCUs provisioned for the agents to enable the feature.run.- Access the alert triage agent on the Microsoft Purview portal.
Compliance considerations:
No compliance considerations identified, review as appropriate for your organization.