To create a case, Insider Risk Management analysts must manually select “Confirm all alerts & create case” in the Purview portal after confirming an alert in the Defender XDR portal (security.microsoft.com). Once a case is created, related content such as online files and emails will be available in the Content explorer tab.

New content that contributes to alerts will continue to be added to the Content explorer for up to 30 days from the case creation date. After this period, any new alert-related content will not be added to the existing case. To access new content, analysts must close the current case and create a new one.

This change is associated with Microsoft 365 Roadmap ID 489228.