HANDS ON SharePoint
HANDS ON Teams
HANDS ON Lists
HANDS ON tek
M365 Admin
Microsoft Purview | Insider Risk Management – Data security alert triage agent generally available
Microsoft Purview Insider Risk Management’s Security Copilot alert triage agent is generally available worldwide from late November to mid-December 2025. It prioritizes alerts, allows user feedback on prioritization, deprecates the file risk section, and requires no action to enable or policy changes.
Microsoft Purview Insider Risk Management (IRM) has reached General Availability for the Security Copilot alert triage agent. The agent helps analysts focus on the most urgent alerts by analyzing and prioritizing Insider Risk Management alerts. It also provides a summary of findings to help users quickly understand the risky activities that make an alert critical to review.
This message is associated with Microsoft 365 Roadmap ID 503764.
When this will happen:
General Availability (Worldwide): Rollout begins in late November 2025 and is expected to complete by mid-December 2025.
How this affects your organization:
- Who is affected: Organizations using Microsoft Purview Insider Risk Management.
- What will happen:
- The alert triage agent will be available by default; no action is required to enable it.
- Users will be able to submit feedback on alert prioritization directly to Microsoft.
- The file risk section in the agent summary will be deprecated.
- No changes to existing admin policies are required.
What you can do to prepare:
- No action is required to enable the feature.
- Access the alert triage agent on the Microsoft Purview portal.
Compliance considerations:
No compliance considerations identified, review as appropriate for your organization.
Message ID: MC1180884
