MC1239175 - Microsoft Purview: Data Security Investigations – AI analysis enhancements

Service

Microsoft Purview

Published

Feb 26, 2026

Tag

New feature
Feature update
User impact

Platforms

Web

Summary

Microsoft Purview is enhancing Data Security Investigations with AI analysis improvements, including automatic preparation of items for AI analysis and a new standard categorization option. Rolling out from mid-March to mid-May 2026, the feature is enabled by default with no admin action required.

More information

Introduction

We’re enhancing AI analysis in Data Security Investigations (DSI) to help analysts evaluate risky content more efficiently. These updates streamline the workflow by automatically preparing items for AI analysis as they're added to an investigation and by introducing a new standard categorization option. Standard categorization can reduce time and cost, while advanced categorization—including AI‑generated topics—remains available.

This message is associated with Microsoft 365 Roadmap ID 557556.

When this will happen

  • Public Preview: Rolling out mid‑March 2026 through mid‑April 2026.
  • General Availability (Worldwide): Rolling out mid‑April 2026 through mid‑May 2026.

How this will affect your organization

Who is affected

  • Microsoft Purview administrators and analysts using Data Security Investigations.
  • All Microsoft 365 tenants with access to DSI capabilities.

What will happen

  • Items added to an investigation will be automatically prepared for AI analysis, reducing manual steps.
  • A new standard categorization option will be available.
  • Advanced categorization (including AI‑generated topics) remains available.
  • No changes to existing admin settings—feature is enabled by default as part of the DSI workflow.
  • Users may notice:
    • Faster categorization and analysis readiness.
    • An updated categorization selection interface.

Screenshot - Data Security Investigations standard vs. advanced categorization:

 user settings

What you can do to prepare

No admin action is required before rollout.

To prepare:

  • Inform analysts and relevant security operations staff about the new categorization options.
  • Update internal documentation if you describe DSI workflows or categorization processes.

Learn:

Compliance considerations

No compliance considerations identified. Review as appropriate for your organization.