Microsoft 365 Message Center ArchiveM365 Archive
Microsoft 365 Roadmap

RM558548Microsoft Purview: Data Security Investigations – analyze files tied to audit log activities

Summary

Speed up analysis of exfiltrated content by launching Data Security Investigations (DSI) from Unified Audit Log activity. In DSI, build your audit log query by specifying criteria such as time range, activities, users, and keywords. DSI then automatically pulls the associated files into the investigation (for example, UserA downloaded a file on 3/1/2026).

Description

Speed up analysis of exfiltrated content by launching Data Security Investigations (DSI) from Unified Audit Log activity. In DSI, build your audit log query by specifying criteria such as time range, activities, users, and keywords. DSI then automatically pulls the associated files into the investigation (for example, UserA downloaded a file on 3/1/2026).

GA date: May CY2026

Preview date: April CY2026

Version history

2 versions tracked

Updated 1 time since Mar 12, 2026. Microsoft 365 Message Center only shows the current version; this archive preserves tracked history.

Compare latest to previous (v1)

Compare any two versions

From
To
  1. May 4, 2026 - 11:00 PMLatest - v2

    Changed: Tags, Status

  2. Mar 12, 2026 - 11:00 PMOriginal - v1

    Changed: Initial version

    View this versionCompare to latest