M365 Archive
Back to latest version
Comparing Jul 17, 2026 → Jul 17, 2026 Swap

MC1430536 - Microsoft Purview: Insider Risk Management - Unified alert queue

Message Center

Metadata at Jul 17, 2026

Message ID

MC1430536

View in Message Center

Published

Jul 17, 2026

Service

Microsoft Purview

Tag

Major change
Feature update
User impact
Admin impact

Metadata changes

End date
Nov 30, 2026Nov 12, 2026

Body changes

removed textadded text

What and Why:

Microsoft is introducingretiring the Frontline Teams Personal Device Onboarding Wizard, a unified alert triageweb-based experience in that helped frontline workers configure Microsoft Purview Insider Risk Management (IRM) that brings agent-driven insights directly into the standard Alerts queue. The most disruptive part of triage often happens before analysts investigate a specific alert—determining which alerts require the most attention. Today, analysts switch between the classic alert queueTeams on their personal Android and Data Security Triage Agent insightsiOS devices. Users will continue to perform that assessment. This update brings those experiences together into a single workflow, enabling analysts to view agent categorizations alongside traditional alert filters, columns,onboard through existing Microsoft Teams, Microsoft Entra ID, Microsoft Intune, and alert details from one location.

With this update, the updated alert details experience embeds agent-generated insights directly into the investigation workflow, helping analysts investigate and take action more efficiently while remaining within the alerts queue. This aligns with Microsoft's Enterprise-ready AI approach by integrating AI-assisted triage capabilities into existing compliance andMicrosoft Authenticator experiences. Existing security workflows while maintaining Insider Risk Management privacy-by-design controls, including pseudonymization, role-based access controls, and auditing capabilities.

To support customer transition, the existing alert and agent triage experiences will remain available for 60 days and can be accessed through the Alerts tabs under Users in the left navigation.

Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks,controls such as IP theft, data leakage,MFA, app protection policies, and security violations. Insider Risk Management enables organizations to create policies based on their own governance, compliance, and security requirements.Conditional Access remain unchanged.

This message is associated with Microsoft 365 Roadmap ID 564621.

Rollout Schedule:

Public Preview:
We began rolling out

  • Retirement begins in mid-August 2026 and completes by late JuneAugust 2026 and expect to complete by mid-July 2026.

    Global:
    We will begin rolling out in early October 2026 and expect to complete by mid October 2026.

    Transition Period:
    Both the classic experience and the new unified experience are planned to remain available for at least 60 days after rollout, with support for both currently planned through August 31, 2026.

    .

Impact on Your Organization:

Who is affected:

  • Microsoft Purview Insider Risk Management administratorsOrganizations using the Frontline Teams Personal Device Onboarding Wizard.
  • Insider Risk Management AnalystsAdministrators managing frontline worker onboarding and BYOD deployments.
  • Insider Risk Management Investigators
  • ComplianceHelpdesk teams and security teams responsible for insider risk investigations and triagefrontline managers.

Platforms/Services:

  • Microsoft Purview
  • Insider Risk Management
  • Data Security Triage Agent
  • Microsoft 365 compliance services
  • Purview web portal

What will happen:

Instead of switching between two

  • The Frontline Teams Personal Device Onboarding Wizard will be retired and will no longer be available to frontline workers on personal Android and iOS devices.
  • Frontline workers will continue to be able to install and sign in to Microsoft Teams using existing Microsoft Teams, Microsoft Entra ID, Intune, and Microsoft Authenticator onboarding experiences, analysts will have a single page where they can:

    • Preview agent summaries, alert details, and user details directly from the alerts list, reducing the needas applicable to open each alert individually.your organization's requirements.
    • Filter all classic and agent attributes on one page, including aNo new Agent Categorization column and the ability to surface agent-triaged alerts that need attention.
    • View and manage the Triage Agent directly from the alerts list.
    • Open, investigate, and act on alerts while remaining within the queue.

    Asadmin controls or configuration changes are required as part of this unification:

    retirement.
This change does not affect:
  • Alert SpotlightMicrosoft Teams access on personal devices.
  • Existing Bring Your Own Device (BYOD) deployments.
  • Multi-factor authentication (MFA).
  • App protection policies.
  • Conditional Access policies.

Only the dedicated onboarding wizard experience is being retired.

  • The toggle between agent and classic alerts is being removed in favor of a single alerts view.
  • Existing Insider Risk Management policies, privacy controls, pseudonymization settings, role-based permissions, and audit capabilities remain unchanged.
  • Both the classic and new experiences will remain available during the transition period.
  • No separate enablement control is described in the announcement.

    • Picture1

    Action Required/Recommendations:

    No immediate actionAction is required.recommended if your organization currently references this onboarding wizard.

    Recommended preparation steps:administrator checklist:

    • Review onboarding documentation for references to the new unified alert experience during preview availability.
    • Validate insider risk investigation workflows with security and compliance teams.
    • Train analysts on:
      • Agent categorization
      • Agent summaries
      • New filtering capabilities
      • Needs Attention prioritization workflow
      Frontline Teams Personal Device Onboarding Wizard.
    • Update internal documentation that references:BYOD deployment guides and frontline worker training materials.
    • Create or update alternative instructions for:
      • Alert SpotlightInstalling Microsoft Teams on Android and iOS devices.
      • Separate Triage Agent dashboardsSigning in to Microsoft Teams.
      • Dashboard toggle functionalityCompleting MFA registration requirements.
      • Completing Intune enrollment or app protection requirements where applicable.
    • Communicate workflow changesthe retirement to Insider Risk Management analystshelpdesk personnel and frontline managers before October 2026 rollout.mid-August 2026.
    • ExploreValidate that existing onboarding documentation points users to Microsoft Teams, Microsoft Entra ID, Microsoft Intune, and Microsoft Authenticator experiences rather than the unified alert queue: New IRM Alert Experience.retired wizard.
    • Review Microsoft documentation: Investigate Microsoft Purview Insider Risk Management activities | Microsoft Learn.
    • Test any internal procedures that rely on current alert triage navigation duringsupport scripts and knowledge articles to ensure they do not reference the transition period.retired experience.

    Suggested Helpdesk Communication

    Microsoft Purview Insider Risk Management is consolidating classic alerts and AI-assisted alert triage into a single unified alert queue. Analysts will have access to agent summaries, user details, and categorization insights directly from the main alerts page. Existing experiences will remain available during a transition period before eventual retirement.

    Compliance Considerations:

    Compliance AreaExplanation
    Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data?Yes. Data Security Triage Agent categorizations, summaries, and prioritization insights are integrated directly into the primary alert triage experience.
    Does the change modify, interrupt, or disable any Purview capabilities?Yes. Alert Spotlight is being retired and the toggle between agent and classic alert experiences is being removed in favor of a unified alert queue.
    Does the change alter how admins can monitor, report on, or demonstrate

    No compliance activities?

    		Yes. Analysts and investigators will triage and manage alerts through a consolidated interface with integrated filtering, categorization, and prioritization capabilities.
    Does the change provide end users any new way of interacting with generative AI?Yes. Insider Risk Management analysts gain direct access to AI-assisted categorizations and agent-driven summaries within the standard alert workflow.
    considerations identified, review as appropriate for your organization.