Microsoft Purview compliance portal: Insider Risk Management user analytics
From Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.Rollout
- Roadmap
- 475058
Rollout dates are often only in the text. When Microsoft moves them, the change shows under "What changed".
Schedule dates changed in the text
Date phrases in schedule sentences differ between the versions this installation saw- Seen 17 Oct 2025
late September 2025, late October 2025→ late January 2026
Read from date phrases in Microsoft's text, not from notice metadata. A changed phrase can be a moved rollout, a new milestone or just rewording; "What changed" below shows which.
What the notice says
Microsoft’s text, safely structuredUpdated October 16, 2025: We have updated the rollout timeline below. Thank you for your patience.
Microsoft Purview Insider Risk Management will be rolling out a new user analytics feature to help Microsoft Defender, Microsoft Purview Data Loss Prevention, and Communication Compliance analysts access an insider risk summary of user activities.
This message is associated with Microsoft 365 Roadmap ID 475058.
When this will happen
Public Preview: We began rolling out in late March 2025 and expect to complete by mid-April 2025.
General Availability (Worldwide, GCC, GCC High, DoD): We will roll out this feature in late January 2026.
How this will affect your organization
With this new feature, Microsoft Defender, Microsoft Purview Data Loss Prevention, and Communication Compliance analysts with the right permissions can access an insider risk summary of user activities that may lead to potential data security incidents as a part of the alert investigation experience in Microsoft Purview and Microsoft Defender. This feature can help analysts gain insider risk context for a specific user and make more informed decisions about responses to potential incidents related to the user.
Insights are generated by Insider Risk Management for potentially risky behaviors of every user and are surfaced across the following experiences:
- User activity summary in Microsoft Purview Data Loss Prevention alerts
- User activity summary in Microsoft Defender alerts and user entity pages
- User activity summary in Communication Compliance policies
What you need to do to prepare
Insider Risk admins can enable user-level insights from Insider Risk Management Settings > Analytics. During the initial rollout, user analytics will be enabled for all customers who have enabled Insider Risk Management Analytics and will include an option to opt-out. Insider Risk admins should ensure data sharing is also enabled from Insider Risk Management Settings > Data Sharing.
Additional information is available here: Enable Analytics in Insider Risk Management.
What changed
Between archive captures, newest first- Tags
New feature, Admin impact→ Updated message, New feature, Admin impact
Updated October 16, 2025: We have updated the rollout timeline below. Thank you for your patience. Microsoft Purview Insider Risk Management will be rolling out a new user … by mid-April 2025. General Availability (Worldwide, GCC, GCC High, DoD): We will
begin rollingroll outin late September 2025 and expect to complete bythis feature in lateOctober 2025.January 2026. How this will affect your organization: With this new feature, Microsoft Defender, …- Tags
- · first version seen
Learn more
Links from the notice and their documentation checksRelated public evidence
No related evidence found in this installation's recent collection. This does not establish that no announcement exists.
Not confirmed here
What this page cannot tell you- Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
- 1 linked page has not been read yet.