Microsoft Purview | Insider Risk Management - Data security alert triage agent generally available
From Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.Rollout
- Roadmap
- 503764
Rollout dates are often only in the text. When Microsoft moves them, the change shows under "What changed".
What the notice says
Microsoft’s text, safely structuredUpdated November 14, 2025: We have updated the content. Thank you for your patience.
Microsoft Purview Insider Risk Management (IRM) has reached General Availability for the Security Copilot alert triage agent. The agent helps analysts focus on the most urgent alerts by analyzing and prioritizing Insider Risk Management alerts. It also provides a summary of findings to help users quickly understand the risky activities that make an alert critical to review.
With this release, users can report miscategorized alerts and provide feedback on prioritization. Feedback is sent directly to Microsoft but is not used for agent memory. We will temporarily disable the ability to add new custom instructions in IRM alert triage agent. Existing instructions will not be honored during this period. This feature will return in 2026. Additionally, the file risk section of the agent summary has been deprecated.
This message is associated with Microsoft 365 Roadmap ID 503764.
When this will happen
General Availability (Worldwide): Rollout begins in late November 2025 and is expected to complete by mid-December 2025.
How this affects your organization
- Who is affected: Organizations using Microsoft Purview Insider Risk Management.
- What will happen:
- The alert triage agent will be available by default; no action is required to enable it.
- Users will be able to submit feedback on alert prioritization directly to Microsoft.
- The file risk section in the agent summary will be deprecated.
- No changes to existing admin policies are required.
What you can do to prepare
- The Microsoft Purview Triage Agents run on Security Compute Units (SCU). Your organization must have SCUs provisioned for the agents to run.
- Access the alert triage agent on the Microsoft Purview portal.
Compliance considerations
No compliance considerations identified, review as appropriate for your organization.
What changed
Between archive captures, newest first- Tags
New feature, User impact, Admin impact→ Updated message, New feature, User impact, Admin impact
Updated November 14, 2025: We have updated the content. Thank you for your patience. Microsoft Purview Insider Risk Management (IRM) has reached General Availability for the … is sent directly to Microsoft but is not used for agent memory. We will temporarily disable the ability to add new custom instructions in IRM alert triage agent. Existing instructions will not be honored during this period. This feature will return in 2026. Additionally, the file risk section of the agent summary has been deprecated. … to existing admin policies are required. What you can do to prepare:
No action is required to enableThe Microsoft Purview Triage Agents run on Security Compute Units (SCU). Your organization must have SCUs provisioned for thefeature.agents to run. Access the alert triage agent on the Microsoft Purview portal. Compliance considerations: …- Tags
- · first version seen
Learn more
Links from the notice and their documentation checksRelated public evidence
No related evidence found in this installation's recent collection. This does not establish that no announcement exists.
Not confirmed here
What this page cannot tell you- Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.