Microsoft Purview | Insider Risk Management - Data security alert triage agent generally available

Microsoft Purview Insider Risk Management (IRM) has reached General Availability for the Security Copilot alert triage agent. The agent helps analysts focus on the most urgent alerts by analyzing and prioritizing Insider Risk Management alerts. It also provides a summary of findings to help users quickly understand the risky activities that make an alert critical to review.

With this release, users can report miscategorized alerts and provide feedback on prioritization. Feedback is sent directly to Microsoft but is not used for agent memory. Additionally, the file risk section of the agent summary has been deprecated.

This message is associated with Microsoft 365 Roadmap ID 503764.

When this will happen:

General Availability (Worldwide): Rollout begins in late November 2025 and is expected to complete by mid-December 2025.

How this affects your organization:

• Who is affected: Organizations using Microsoft Purview Insider Risk Management.
• What will happen:
  • The alert triage agent will be available by default; no action is required to enable it.
  • Users will be able to submit feedback on alert prioritization directly to Microsoft.
  • The file risk section in the agent summary will be deprecated.
  • No changes to existing admin policies are required.

What you can do to prepare:

• No action is required to enable the feature.
• Access the alert triage agent on the Microsoft Purview portal.

Compliance considerations:

No compliance considerations identified, review as appropriate for your organization.