Posted by Insider Risk Management single alert queue
Status: Preview – documented July 2026
There are multiple items in this category. So let’s dig in. The Triage Agent dashboard and the standard alert dashboard are being combined into a single alerts list, so classic and agent-triaged alerts are managed in one place, with agent summaries and alert and user details available directly on the list.
User profile detail expands with Microsoft Entra signals including office location, employee type, department and last working date, and analysts can now add notes on both alerts and cases, with system-generated notes applied automatically on changes to status, assignment, closure or case escalation.
By the way – I had this conversation not to long ago with an organization; Expanding personal attributes inside an investigative workflow engages works council consultation and data protection assessment requirements in several European jurisdictions, and should not be enabled on the assumption that a technical preview is a legal clearance.
Permanent deletion under priority cleanup approval
Status: Updated – documented July 2026
Priority cleanup policies expedite the permanent deletion of (sensitive/redundant) information from mailboxes. Let’s say we have meeting transcripts that are covered by a retention policy for seven years – but these are redundant after six months. Priority cleanup allows us to remove these, when needed.
But this will require oversight and this was provided with an approval workflow. Now this workflows requires three separate approvers: one Priority Cleanup administrator, one retention manager and one eDiscovery administrator. This applies separation of duties (when correctly implemented in the organization itself) to the single most irreversible action the platform can take.
Purview role-group assignments expiration
Status: Updated – documented July 2026
As we know, Purview roles (not the Compliance Administrator) are not part of Entra ID Priveledged Identiyy Management and just-in-time-access. Now however, role-group assignments (excluding eDicovery Administrator and eDiscovery Manager) in Microsoft Purview can be configured with an expiration date, so that access is revoked automatically. This is a great addition without requirering additional tooling or licensing.
Fabric insights, Data Map continuity, and withdrawn scope
Status: Updated, New and Retired – documented July 2026
Administrators can now use Microsoft Fabric governance experiences in the OneLake catalog to understand DLP activity and adoption, identifying evaluated workspaces, locating sensitive information, tracking policy adoption and prioritizing high-risk assets. Purview protection policies no longer support Azure SQL Database. I am not sure why this scope has changed. There are some other changes coming, which I will probably do a write-up on in the next article.
Copilot: prevent using external emails
Status: Preview — Data Loss Prevention, June 2026 release notes
I am still confinced that DLP is one of the greatest and core components of information protection in the new Frontier/Agentic world. And the functionality keeps expanding. A new “Email is received from > External users” condition for the Microsoft 365 Copilot and Copilot Chat policy location prevents Copilot from using externally originated emails. The main reason: the prevent prompt-injection attacks.
This is one of the earlier attack-vectors: sending an email using the html-body to include AI prompts and commands. As the email is opened by the user (your CFO for example), the prompt will be using these credentials. This DLP condition might just become crucial for your tenant protection.
Agent 365 GA
Status: Generally available — May 2026 release notes
In May, Agent 365 became generally available and also part of the new Microsoft 365 E7 licensing suite. Any organization now has a supported means of establishing what agents are used, requested and what data was involved.
Purview and Anthropic Claude (Enterprise)
Status: Preview — May 2026 release notes
Organizations can add and configure an Anthropic Claude data connector, after which Claude appears as another AI application alongside Microsoft 365 Copilot, Copilot Studio, ChatGPT Enterprise and others. Activity explorer can be used to see individual Claude interactions — who used it, when, and what kinds of content were involved — in the same way as for other AI applications.
Extending protection to AWS Bedrock agents
Status: Guidance published on the Microsoft Purview blog, Microsoft Tech Community, 5 June 2026
Microsoft has published guidance for extending Microsoft Purview data protection to AWS Bedrock agents for cross-cloud AI governance, addressing the common pattern in which an organization governs with Microsoft 365 and Purview while running AI workloads in more than one cloud.
Endpoint DLP scope to device groups
Status: New — Data Loss Prevention, June 2026 release notes
An Endpoint DLP policy can be scoped to specific device groups — for example, enforcing a policy when Finance users access data from Windows devices but not when the same users work from macOS — using dynamic device groups defined in Microsoft Entra ID. Uniform enforcement was a bottleneck for organizations as it can be disruptive for other users.
Endpoint DLP telemetry queries
Status: New — Data Loss Prevention, June 2026 release notes
Endpoint DLP device configuration and policy-sync attributes can be queried at scale through the DlpInfo column of the DeviceInfo table in Advanced Hunting in the Microsoft Defender portal, instead of relying on point-in-time exports from the Microsoft Purview portal. A separate device health reports dashboard provides monitoring of device onboarding status, policy update readiness and feature readiness for Endpoint DLP.
Endpoint DLP evidence data source
Status: Preview (endpoint DLP evidence collection); general availability for notifications; Updated for automatic data preparation — Data Security Investigations, June 2026 release notes
Investigators can query data captured by endpoint DLP policies on onboarded devices and add the associated content to an investigation scope for AI-assisted analysis, enabling aggregate analysis of endpoint exfiltration events instead of per-alert triage. Data preparation now runs automatically in the background as items are added to scope, removing a manual vectorization step, and email and portal notifications for Data Security Investigations are generally available.
Selective monitoring of generative AI applications
Status: Generally available — Insider Risk Management, June 2026 release notes
For Microsoft Copilot experiences and enterprise AI applications, organizations can now select or deselect which generative AI applications are monitored in Insider Risk Management policy indicators. The two main purposes for this is reducing alert noise and avoiding unnecessary pay-as-you-go billing charges.