Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources, documents or advisories need attention: 274/275 feeds/APIs · 469/469 docs · 8/9 advisories · checked 21:06 UTC Customize Public modeDiscuss ChangeIntel on Discord

Microsoft Purview: Insider Risk Management - Data Security Investigation integration

Microsoft 365 Message Center Archive by Merill Fernando

Summary

Launch a pre-scoped Data Security Investigation (DSI) from an IRM case. When a data security admin identifies a risky user who needs deeper investigation, they can launch a pre-scoped investigation directly from an IRM case, allowing them to view content analysis related to that user and better assess post-incident data impact.

Status
Launched
General availability target
Nov 2025
Preview target
Jul 2025
Clouds
Worldwide (Standard Multi-Tenant)
Release phases
General Availability
Platforms
Web
Source created
26 Mar 2025
Source modified
21 Jan 2026 · 10mo ago
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 11 Nov 21:06 UTC · 274 of 275 readable · 273 fully read · documentation 469/469 current