MC1430536 - Microsoft Purview: Insider Risk Management - Unified alert queue

What and Why:

Microsoft is retiringintroducing a unified alert triage experience in Microsoft Purview Insider Risk Management (IRM) that brings agent-driven insights directly into the Frontline Teams Personal Device Onboarding Wizard,standard Alerts queue. The most disruptive part of triage often happens before analysts investigate a web-specific alert—determining which alerts require the most attention. Today, analysts switch between the classic alert queue and Data Security Triage Agent insights to perform that assessment. This update brings those experiences together into a single workflow, enabling analysts to view agent categorizations alongside traditional alert filters, columns, and alert details from one location.

With this update, the updated alert details experience embeds agent-generated insights directly into the investigation workflow, helping analysts investigate and take action more efficiently while remaining within the alerts queue. This aligns with Microsoft's Enterprise-ready AI approach by integrating AI-assisted triage capabilities into existing compliance and security workflows while maintaining Insider Risk Management privacy-by-design controls, including pseudonymization, role-based experience that helped frontline workers configure access controls, and auditing capabilities.

To support customer transition, the existing alert and agent triage experiences will remain available for 60 days and can be accessed through the Alerts tabs under Users in the left navigation.

Microsoft TeamsPurview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables organizations to create policies based on their personal Androidown governance, compliance, and iOS devices. Users will continue to onboard through existingsecurity requirements.

This message is associated with Microsoft Teams, Microsoft Entra ID, Microsoft Intune, and Microsoft Authenticator experiences. Existing security controls such as MFA, app protection policies, and Conditional Access remain unchanged.365 Roadmap ID 564621.

Rollout Schedule:

• Retirement begins

  Public Preview:
  We began rolling out in late June 2026 and expect to complete by mid-July 2026.

  mid-Global:
  We will begin rolling out in early October 2026 and expect to complete by mid October 2026.

  Transition Period:
  Both the classic experience and the new unified experience are planned to remain available for at least 60 days after rollout, with support for both currently planned through August 2026 and completes by late August 2026.

31, 2026.

Impact on Your Organization:

Who is affected:

• Organizations using the Frontline Teams Personal Device Onboarding Wizard.Microsoft Purview Insider Risk Management administrators
• Administrators managing frontline worker onboardingInsider Risk Management Analysts
• Insider Risk Management Investigators
• Compliance and BYOD deployments.
• Helpdesksecurity teams responsible for insider risk investigations and frontline managers.triage

Platforms/Services:

• Microsoft Purview
• Insider Risk Management
• Data Security Triage Agent
• Microsoft 365 compliance services
• Purview web portal

What will happen:

Instead of switching between two experiences, analysts will have a single page where they can:

• The Frontline Teams Personal Device Onboarding Wizard will be retiredPreview agent summaries, alert details, and will no longer be availableuser details directly from the alerts list, reducing the need to frontline workersopen each alert individually.
• Filter all classic and agent attributes on personal Androidone page, including a new Agent Categorization column and iOS devices.the ability to surface agent-triaged alerts that need attention.
• Frontline workers will continue to be able to installView and sign in to Microsoft Teams using existing Microsoft Teams, Microsoft Entra ID, Intune,manage the Triage Agent directly from the alerts list.
• Open, investigate, and Microsoft Authenticator onboarding experiences, as applicable to your organization's requirements.act on alerts while remaining within the queue.
• No new admin controls or configuration changes are required as

As part of this retirement.This change does not affect:unification:

• Microsoft Teams access on personal devices.Alert Spotlight is being retired.
• The toggle between agent and classic alerts is being removed in favor of a single alerts view.
• Existing Bring Your Own Device (BYOD) deployments.Insider Risk Management policies, privacy controls, pseudonymization settings, role-based permissions, and audit capabilities remain unchanged.
• Multi-factor authentication (MFA).Both the classic and new experiences will remain available during the transition period.
• App protection policies.
• Conditional Access policies.No separate enablement control is described in the announcement.

Only the dedicated onboarding wizard experience is being retired.Picture1

Action Required/Recommendations:

ActionNo immediate action is recommended if your organization currently references this onboarding wizard.required.

Recommended administrator checklist:preparation steps:

• Review onboarding documentation for references to the Frontline Teams Personal Device Onboarding Wizard.new unified alert experience during preview availability.
• Validate insider risk investigation workflows with security and compliance teams.
• Train analysts on:
  • Agent categorization
  • Agent summaries
  • New filtering capabilities
  • Needs Attention prioritization workflow
• Update BYOD deployment guides and frontline worker training materials.internal documentation that references:
  • Alert Spotlight
  • Create or update alternative instructions for:
    • Installing Microsoft Teams on Android and iOS devices.Separate Triage Agent dashboards
    • Signing in to Microsoft Teams.
    • Completing MFA registration requirements.
    • Completing Intune enrollment or app protection requirements where applicable.Dashboard toggle functionality
  • Communicate the retirementworkflow changes to helpdesk personnel and frontline managersInsider Risk Management analysts before mid-August 2026.October 2026 rollout.
  • Validate that existing onboarding documentation points users to Microsoft Teams, Microsoft Entra ID, Microsoft Intune, and Microsoft Authenticator experiences rather thanExplore the retired wizard.unified alert queue: New IRM Alert Experience.
  • Review support scripts and knowledge articles to ensure they do not referenceMicrosoft documentation: Investigate Microsoft Purview Insider Risk Management activities | Microsoft Learn.
  • Test any internal procedures that rely on current alert triage navigation during the retired experience.transition period.

  Suggested Helpdesk Communication

  Microsoft Purview Insider Risk Management is consolidating classic alerts and AI-assisted alert triage into a single unified alert queue. Analysts will have access to agent summaries, user details, and categorization insights directly from the main alerts page. Existing experiences will remain available during a transition period before eventual retirement.

  Compliance Considerations:

  No

  Compliance Area	Explanation
  Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data?	Yes. Data Security Triage Agent categorizations, summaries, and prioritization insights are integrated directly into the primary alert triage experience.
  Does the change modify, interrupt, or disable any Purview capabilities?	Yes. Alert Spotlight is being retired and the toggle between agent and classic alert experiences is being removed in favor of a unified alert queue.
  Does the change alter how admins can monitor, report on, or demonstrate compliance considerations identified, review as appropriate for your organization. activities?	Yes. Analysts and investigators will triage and manage alerts through a consolidated interface with integrated filtering, categorization, and prioritization capabilities.
  Does the change provide end users any new way of interacting with generative AI?	Yes. Insider Risk Management analysts gain direct access to AI-assisted categorizations and agent-driven summaries within the standard alert workflow.