Microsoft Purview | Insider Risk Management triage agent summaries available in Microsoft Defender

What and why

We're introducing Insider Risk Management (IRM) triage agent summaries in Microsoft Defender. This enhancement helps investigators review key risk insights directly from the Defender alert queue, reducing the need to switch between security tools during alert triage.

When the IRM triage agent is enabled and Insider Risk Management alerts are shared with Microsoft Defender, supported alerts will include AI-generated summaries such as alert categorization, investigation findings, observed risk patterns, and relevant user context. Investigators can continue to access the complete investigation experience in Microsoft Purview for deeper analysis.

This message is associated with Microsoft 365 Roadmap ID 567472.

Rollout schedule

• Public Preview: Beginning in mid-August 2026 and expected to complete in early September 2026
• General Availability (Worldwide): Beginning in early December 2026 and expected to complete in late December 2026

Impact on your organization

Who is affected

• Organizations that share Microsoft Purview Insider Risk Management alerts with Microsoft Defender
• Organizations that have the IRM triage agent enabled and active
• Security analysts and investigators who review Insider Risk Management alerts in Microsoft Defender

Platforms and services

• Microsoft Defender
• Microsoft Purview Insider Risk Management
• Web

What will happen

• Supported Insider Risk Management alerts in Microsoft Defender will display IRM triage agent summaries:
• Summaries may include alert categorization, investigation findings, identified risk patterns, and relevant user context.
• The feature will be enabled automatically for organizations that meet the prerequisites.
• Existing alert-sharing configurations between Insider Risk Management and Microsoft Defender will be preserved.
• There is no impact to existing configurations or workflows.
• After rollout, investigators can:

• Review Insider Risk Management alerts in Microsoft Defender.
• Access the full investigation experience in Microsoft Purview when needed.

Action required and recommendations

No action is required if your organization already meets the prerequisites.

Review the following to ensure readiness:

• Confirm that Insider Risk Management alerts are being shared with Microsoft Defender.
• Confirm that the IRM triage agent is deployed and active.
• Inform security operations and investigation teams about the new triage experience.
• Update any internal documentation that references Insider Risk Management alert investigations.

Compliance considerations