What and Why:
Microsoft is introducing a unified alert triage experience in Microsoft Purview Insider Risk Management (IRM) that brings agent-driven insights directly into the standard Alerts queue. The most disruptive part of triage often happens before analysts investigate a specific alert—determining which alerts require the most attention. Today, analysts switch between the classic alert queue and Data Security Triage Agent insights to perform that assessment. This update brings those experiences together into a single workflow, enabling analysts to view agent categorizations alongside traditional alert filters, columns, and alert details from one location.
With this update, the updated alert details experience embeds agent-generated insights directly into the investigation workflow, helping analysts investigate and take action more efficiently while remaining within the alerts queue. This aligns with Microsoft's Enterprise-ready AI approach by integrating AI-assisted triage capabilities into existing compliance and security workflows while maintaining Insider Risk Management privacy-by-design controls, including pseudonymization, role-based access controls, and auditing capabilities.
To support customer transition, the existing alert and agent triage experiences will remain available for 60 days and can be accessed through the Alerts tabs under Users in the left navigation.
Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables organizations to create policies based on their own governance, compliance, and security requirements.
This message is associated with Microsoft 365 Roadmap ID 564621.
Rollout Schedule:
Public Preview:
We began rolling out in late June 2026 and expect to complete by mid-July 2026.
Global:
We will begin rolling out in early October 2026 and expect to complete by mid October 2026.
Transition Period:
Both the classic experience and the new unified experience are planned to remain available for at least 60 days after rollout, with support for both currently planned through August 31, 2026.
Impact on Your Organization:
Who is affected:
- Microsoft Purview Insider Risk Management administrators
- Insider Risk Management Analysts
- Insider Risk Management Investigators
- Compliance and security teams responsible for insider risk investigations and triage
Platforms/Services:
- Microsoft Purview
- Insider Risk Management
- Data Security Triage Agent
- Microsoft 365 compliance services
- Purview web portal
What will happen:
Instead of switching between two experiences, analysts will have a single page where they can:
- Preview agent summaries, alert details, and user details directly from the alerts list, reducing the need to open each alert individually.
- Filter all classic and agent attributes on one page, including a new Agent Categorization column and the ability to surface agent-triaged alerts that need attention.
- View and manage the Triage Agent directly from the alerts list.
- Open, investigate, and act on alerts while remaining within the queue.
As part of this unification:
- Alert Spotlight is being retired.
- The toggle between agent and classic alerts is being removed in favor of a single alerts view.
- Existing Insider Risk Management policies, privacy controls, pseudonymization settings, role-based permissions, and audit capabilities remain unchanged.
- Both the classic and new experiences will remain available during the transition period.
- No separate enablement control is described in the announcement.
Picture1
Action Required/Recommendations:
No immediate action is required.
Recommended preparation steps:
- Review the new unified alert experience during preview availability.
- Validate insider risk investigation workflows with security and compliance teams.
- Train analysts on:
- Agent categorization
- Agent summaries
- New filtering capabilities
- Needs Attention prioritization workflow
- Update internal documentation that references:
- Alert Spotlight
- Separate Triage Agent dashboards
- Dashboard toggle functionality
- Communicate workflow changes to Insider Risk Management analysts before October 2026 rollout.
- Explore the unified alert queue: New IRM Alert Experience.
- Review Microsoft documentation: Investigate Microsoft Purview Insider Risk Management activities | Microsoft Learn.
- Test any internal procedures that rely on current alert triage navigation during the transition period.
Suggested Helpdesk Communication
Microsoft Purview Insider Risk Management is consolidating classic alerts and AI-assisted alert triage into a single unified alert queue. Analysts will have access to agent summaries, user details, and categorization insights directly from the main alerts page. Existing experiences will remain available during a transition period before eventual retirement.
Compliance Considerations:
| Compliance Area |
Explanation |
| Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data? |
Yes. Data Security Triage Agent categorizations, summaries, and prioritization insights are integrated directly into the primary alert triage experience. |
| Does the change modify, interrupt, or disable any Purview capabilities? |
Yes. Alert Spotlight is being retired and the toggle between agent and classic alert experiences is being removed in favor of a unified alert queue. |
| Does the change alter how admins can monitor, report on, or demonstrate compliance activities? |
Yes. Analysts and investigators will triage and manage alerts through a consolidated interface with integrated filtering, categorization, and prioritization capabilities. |
| Does the change provide end users any new way of interacting with generative AI? |
Yes. Insider Risk Management analysts gain direct access to AI-assisted categorizations and agent-driven summaries within the standard alert workflow. |