Microsoft Security roadmap explorer

Improving permission checks when users access the Microsoft Purview portal. Enhanced audit logs will provide clearer visibility into role and scoped-role access decisions, helping administrators troubleshoot access issues and monitor authorization outcomes.

Your organization can now control who can access your data depending on the sensitive information detected in Fabric semantic models and lakehouses. DLP restrict access action allows you to block access to guest users or all users depending on what labels or sensitive information types…

Previously, auto expanding archive mailbox expansion was supported only up to 1.5 TB, after which mailboxes would become inoperative. Archive mailboxes can now automatically expand beyond the 1.5 TB limit, ensuring uninterrupted retention and enabling scalable archive growth as storage thresholds are reached. This capability…

We’re introducing a new guided diagnostics experience to help users understand why their DLP policies may not be behaving as expected. This experience provides a clear summary of why a DLP action was taken on a document, including which policies were triggered, the order of…

AI agent skill to detect and alert unhealthy policy sync and device configuration.

AI-powered visibility into DLP policy deployment across devices, helping admins track sync progress and understand enforcement coverage. They proactively identify impacted devices, explain root causes of sync failures, and guide admins with recommended actions to quickly diagnose and resolve issues.

For each enforced auto-labeling policy, admins can view how files processed during enforcement correlate to the latest simulation run. The per-policy coverage report shows volumes of files that have been labeled or are not yet labeled, and whether those files were included in the last…

Microsoft Purview is improving auto-labeling capabilities to help organizations manage and validate labeling policies at enterprise scale. These enhancements expand support for larger SharePoint scopes, improve policy management flexibility, and provide richer visibility into auto-labeling activity.

We’re introducing the new readiness for Microsoft Copilot and data explorer experiences in Microsoft Purview Data Security Posture Management (DSPM). These new capabilities provide data security teams with greater visibility into their organization’s data security posture and help them assess risks, investigate findings, and prioritize…

We are increasing the maximum auto-labeling capacity for SharePoint and OneDrive from 100,000 up to 500,000 files per tenant per day. This helps organizations label and protect more of their data at rest, faster, closing labeling gaps across existing content. With sensitivity labels and protection…

Microsoft Purview Data Loss Prevention is introducing more granular, role-based access to the Devices page under Settings → Device Onboarding. Previously, viewing or managing device onboarding required broad administrative roles (such as Compliance Administrator, Global Administrator, or Security Administrator). With this update, organizations can grant…

We are expanding Microsoft Purview DLP for Microsoft 365 Copilot and Copilot Chat to safeguard risks from external emails. This real-time control helps organizations mitigate data risks by preventing Microsoft 365 Copilot and Chat from processing emails from senders external to your organization.

Endpoint DLP support for FTP and SFTP enables organizations to monitor and protect sensitive data transferred from managed endpoints using FTP and SFTP, helping prevent unauthorized data exfiltration while maintaining visibility and control.

Microsoft Purview Data Loss Prevention (DLP) is expanding to Microsoft Cowork, enabling data security admins to use a single policy across Microsoft 365 Copilot and Cowork. The integration helps protect sensitive AI interactions by preventing the use of labeled knowledge sources, blocking prompts that contain…

Microsoft Purview collection and data loss prevention (DLP) policies will support browser inline protection for a significantly broader set of unmanaged generative AI apps in Edge for Business. Admins can use existing Purview policy experiences to detect and protect sensitive data shared through supported browser…

Access to Archive mailboxes (Main + Auxiliary) through Microsoft Graph. The goal is to give users a single, seamless Archive view, even though Archive data may physically reside across multiple auxiliary mailboxes with EWS Graph APIs getting deprecated by OCT 2026.

Let tenants trim file-version bloat created by retention, without breaking compliance promises. SharePoint/compliance admins at large, regulated enterprises must cap and reclaim storage consumed by retained file versions, while keeping legal-hold and records promises intact. Admins with appropriate Purview RBAC can enable version cleanup for…

Self-service diagnostics help identify common issues with case permissions, security filters, and policy status. The experience highlights potential misconfigurations and provides simple guidance to help customers understand and resolve them. This brings basic troubleshooting into the product and helps eDiscovery admins overcome common challenges.

Microsoft Purview server-side auto-labeling will support legacy Microsoft Office file formats, including Word (.doc), Excel (.xls), and PowerPoint (.ppt). Organizations can automatically evaluate and apply sensitivity labels to these files in SharePoint and OneDrive.

As AI agents become deeply embedded in enterprise ecosystems, they are evolving beyond simple tools or workflows into a digital workforce. These agents can interpret intent, access and manipulate enterprise data, execute actions and even make real-time decisions. In many ways, they operate like human…

Enhance Content Explorer by introducing new summary metrics that provide better visibility into scanning and classification activities. This update will include: Unscanned Files Summary Displays the count and percentage of files that have not been scanned for classification, helping admins identify gaps and take corrective…

Microsoft Purview network data security now integrates with Palo Alto Prisma Access, extending discovery and protection to network traffic. With this integration, new and existing Palo Alto Prisma Access customers can configure Microsoft Purview collection and data loss prevention policies to discover and protect sensitive…

Microsoft Purview Data Loss Prevention and Information Protection Auto-labeling capabilities now extend to non-Microsoft connected apps (e.g., Google Workspace, Box, Dropbox, Salesforce, ServiceNow, Amazon Web Services, and Cisco Webex). The conditions and actions supported for each of these applications vary.

Configure retention for Microsoft 365 Copilot memory to help preserve historical versions of memory items for security, compliance, and investigation scenarios. Copilot memory includes saved memories and details inferred from chat history that enable more personalized and context-aware Copilot experiences. Copilot memory items are stored…

Improving permission checks when users access the Microsoft Purview portal. Enhanced audit logs will provide clearer visibility into role and scoped-role access decisions, helping administrators troubleshoot access issues and monitor authorization outcomes.

The Unified Classification Management Experience unifies every classifier in Microsoft Purview—Sensitive Information Types (SITs), Exact Data Match (EDM), fingerprint SITs, and trainable classifiers—into one place to discover, create, validate, and manage classifiers.

Learn about the state of your scanned repositories and create custom reports with the information protection scanner. Labeling, classification and protection actions on scanned files are stored in SQL tables that form a foundation to feed into custom reports.

Three updates are coming to enhance policy conditions. First, our updated policy conditions enable the detection of messages sent and received both to and from external email addresses, allowing you to identify specific instances of information being shared with external contacts. Secondly, with the new…

Endpoint DLP now extends protection to files stored in commonly excluded Windows folders, including Temp and AppData. This helps improve coverage by detecting and protecting sensitive data in these locations.

Some existing retention policies scoped to Microsoft Teams may currently also apply to Microsoft 365 Copilot interactions. As part of an upcoming change, these legacy Teams retention policies will be converted to—and treated as—Teams-only policies. They will no longer implicitly govern Copilot workloads.

Data Lifecycle Management allows compliance admins to retain, review and delete content in M365 workloads. Deletion of content to adhere to compliance requirements, admins can set up Retention policies or labels. To help prevent inadvertent data loss, M365 retention labels policies and M365 retention policies…

As of today, whenever the user wants to enable email notifications the policy tips also need to be enabled and vice versa, but with this decoupling the admin can configure the following: 1) None of policy tips or email notification 2) Only policy tips 3)…

This feature is about improving the alerting capabilities and customization in Communication Compliance.

Adaptive Protection in Microsoft Purview helps you protect your organization’s data by integrating dynamic insider risk levels, determined by data related activities, with various policy engines to automatically moving users in and out of policies as their risk levels change over time. The integration with…

Azure PST Import is a migration method that enables PST files stored in Azure Blob Storage to be imported directly into Exchange Online mailboxes. It follows the standard two‐step Exchange Migration Service pattern: an initial analysis phase to validate and assess PST data, followed by…

Azure PST Import is a migration method that enables PST files stored in Azure Blob Storage to be imported directly into Exchange Online mailboxes. It follows the standard two‐step Exchange Migration Service pattern: an initial analysis phase to validate and assess PST data, followed by…

Adaptive Protection in Microsoft Purview helps you protect your organization’s data by integrating dynamic insider risk levels, determined by data related activities, with various policy engines to automatically moving users in and out of policies as their risk levels change over time. The integration with…

Access to Archive mailboxes (Main + Auxiliary) through Microsoft Graph. The goal is to give users a single, seamless Archive view, even though Archive data may physically reside across multiple auxiliary mailboxes with EWS Graph APIs being deprecated.

Insider risk management will be introducing the ability to classify alerts as True positive, Benign (operational), and False positive. This will be available on all alerts where authorized analysts with the appropriate permissions can choose from a list of predefined classification reasons. Alert classification will…

Extend Microsoft Purview Data Loss Prevention (DLP) policies to filter sensitive files at the network layer by integrating with Entra Global Secure Access Internet Access. This integration enables organizations to intercept and inspect files at the network layer and enforce restrictive actions based on DLP…

Extend Microsoft Purview data security controls to the network layer to detect and protect sensitive data in text and prompts by integrating with Entra Internet Access. This integration enables organizations to intercept and inspect text and AI interactions at the network layer, enforce restrictive actions…

Out-of-box MTTA/MTTD/MTTR SLA Alert Reporting dashboard showing past trends, Top SITs getting exposed via DLP alerts generated. Customers can define their custom SLAs for high, med and low severity alerts and get access to dashboard showing operational performance and SLA metrics.

Purview SDK embedded in Agent Framework SDK enables developers to seamlessly integrate enterprise-grade security, compliance, and governance into the AI agents they build. This integration enables automatic classification and protection of sensitive data, prevents data leaks and oversharing, and provides visibility and control for regulatory…

This feature in Purview Compliance Manager shall enable customers to automatically access the compliance posture of Agents created in AI Foundry. Customers can map Agents being created in AI Foundry to compliance regulations and assessments in Purview Compliance Manager and get to know the compliance…

With the introduction of file archiving support in SharePoint Online, administrators are looking to seamlessly include archiving actions within their existing data retention policies. This means that, in addition to keeping or deleting data, admins want to now leverage Purview DLM to archive files according…

Ability to apply Retention labels and policies to items on OneDrive and SharePoint based on when the items were last accessed by an user.

With this feature, IRM alerts and other supporting data will be available in the following Microsoft Defender XDR experiences: IRM alerts will be surfaced in unified alert and Incident queue in Microsoft Defender XDR. IRM alerts, Indicators and enriched events will be available in Microsoft…

Microsoft Purview Adaptive Scopes will provide administrators with explicit control over lifecycle-state evaluation for recipients and site owners, helping ensure policy targeting and scope membership remain aligned with organizational requirements.

This creates the ability to apply Retention to each SharePoint or OneDrive item based on when it was last accessed by a user. #copilotcontrolsystem

This feature is bringing the Information Protection Filer Labeler and Viewer applications to the MacOS platform. Enabling customers to have the same capabilities available on Mac. Core functionality will be available with the exception of the Advanced label-based protection feature.

The Microsoft Rights Management (RMS) connector is moving from shared-secret authentication to certificate-based authentication, improving its security posture. With this update, administrators configure their own Microsoft Entra app registration and certificate, then use the new PowerShell module to configure the certificate for each workload (Connector…

Microsoft Purview server-side auto-labeling will support legacy Microsoft Office file formats, including Word (.doc), Excel (.xls), and PowerPoint (.ppt). Organizations can automatically evaluate and apply sensitivity labels to these files in SharePoint and OneDrive.

Microsoft Purview Data Loss Prevention is extending Administrative Units support to Microsoft 365 Copilot, Copilot Chat, and Cowork. This enables organizations to delegate management of supported Copilot DLP policies to administrators within their assigned Administrative Units, supporting regional, departmental, and regulatory boundaries without granting tenant-wide…

With this update, Risky AI usage policy template will support priority content. Customers can define Sensitive Info Types (SITs), Trainable Classifiers, Sensitivity Labels as priority content, and get alerted only when the activity matches the selected priority content. Microsoft Purview Insider Risk Management correlates various…

When files are opened in Windows, the operating system, and applications (for example, Microsoft Office and browsers) can create, rename, and delete temporary files as part of normal behavior. The Endpoint client audits these activities, resulting in high-volume, low-signal events that appear as “noise” for…

We are introducing file archiving support in SharePoint Online, utilizing this feature administrators can seamlessly include archiving actions within their existing data retention policies. This means that, in addition to keeping or deleting data, admins can now leverage Purview DLM to archive files according to…

Alert auto-resolution & tagging rules let you tell DLP, in advance, how to handle predictable alerts. You define a rule once, and from then on DLP applies it automatically to every new alert: ● Resolve alerts you don't need to see - e.g., Low-severity alerts…

Enables auto‐labeling of existing SharePoint files to match the default sensitivity label configured on their document library. This helps organizations close labeling gaps for data at rest and ensure consistent, secure‐by‐default protection across SharePoint libraries—without relying on manual user labeling.

With this feature, admins can scope their network data security data loss prevention policies, integrated with Entra GSA Internet Access, to apply to all websites ( . ) or all websites except specific cloud apps, allowing them to apply protection to cloud apps and websites…

Optical character recognition (OCR) support will detect sensitive content in images and subsequently apply data loss prevention (DLP) policies to prevent exfiltration of that sensitive data on your Windows endpoint devices. This release supports key file types like JPG, JPEG, PNG, TIFF, BMP and PDF…

At Ignite, Microsoft is introducing a major evolution of Purview Data Security Posture Management (DSPM) to help organizations strengthen data security and confidently embrace AI. The new DSPM experience unifies visibility and control across traditional data and AI-driven environments, delivering outcome-based guided workflows that turn…

A new export functionality will be introduced in two locations: the Data Loss Prevention > Policies page and the Information Protection > Label publishing policies page. This feature will allow users to export their existing DLP configurations and label policies, including schema, as a downloadable…

Apply sensitivity labels to Microsoft Entra cloud security groups to extend the classification and governance you already use for Microsoft 365 groups. The same labels you publish in the Microsoft Purview portal and configure for groups and sites apply automatically to cloud security groups, with…

Optical character recognition (OCR) support will detect sensitive content in images and subsequently apply data loss prevention (DLP) policies to prevent exfiltration of that sensitive data in SharePoint Online and OneDrive. This release supports key file types like JPG, JPEG, PNG, TIFF, BMP, and PDF…

In Word, Excel, and PowerPoint, the ‘Prevent some connected experiences that analyze content’ label setting now prevents files in these apps from being sent to all Microsoft connected experiences for analysis, rather than a subset of these connected experiences.

We’re enhancing the User section within Insider Risk Management alerts to provide investigators with more contextual user profile and risk attributes directly within their workflow. With this update, analysts can now view key user details such as employee type, office location, start date, policy inclusion…

We’re introducing a new collaboration capability in Insider Risk Management that enables analysts and investigators to add notes directly within alerts. With this feature, users can document investigation progress, share findings, and capture key context throughout the triage process. In addition to manually added notes…

We are introducing a new integrated Microsoft Purview Data Loss Prevention (DLP) capability for Intune Mobile Application Management (MAM)-protected mobile apps, enabling organizations to apply content‐aware protection policies to sensitive data on mobile devices. This integration ensures that clipboard actions in managed mobile apps are…

We are increasing the maximum auto-labeling capacity for SharePoint and OneDrive from 100,000 up to 500,000 files per tenant per day. This helps organizations label and protect more of their data at rest, faster, closing labeling gaps across existing content. With sensitivity labels and protection…

Microsoft Purview is upgrading inline data protection for Microsoft Entra-managed apps in Edge for Business. The experience integrates with a Microsoft Entra Conditional Access grant control and simplifies configuration while removing current Purview policy restrictions. Admins can now use expanded conditions and condition combinations, multiple…

Previously, auto-expanding archive mailbox expansion was supported only up to 1.5 TB, after which mailboxes would become inoperative. Archive mailboxes can now automatically expand beyond the 1.5 TB limit, ensuring uninterrupted retention and enabling scalable archive growth as storage thresholds are reached. This capability to…

Enables cloud attachment preservation for users put on infinite hold so that file versions shared are preserved across any OneDrive or SharePoint site. This is a new capability which is different from the existing capability of applying label to cloud attachments and links present in…

Enables auto‐labeling of existing SharePoint files to match the default sensitivity label configured on their document library. This helps organizations close labeling gaps for data at rest and ensure consistent, secure‐by‐default protection across SharePoint libraries—without relying on manual user labeling.

A new feature will be introduced on the main Classification page, allowing users to test files against all available classifiers to identify the presence of sensitive information. Users will have the option to select a single classifier or run tests across all classifiers. This capability…

Microsoft Purview is introducing a new view-only role management role to give admins permissions to see all the member assignments in Purview and Defender portal. This addition will be added to Global Reader and Security Reader in Purview and Entra.

Microsoft Purview is introducing the ability to set a limit in days when assigning users and security groups to role groups. This allows admins to define a fixed duration when providing admin permission on a temporary basis.

B2B users, including internal guest users and external users, will be able to register and sign in with passkeys issued by a resource tenant to meet that tenant's multifactor authentication (MFA) requirements. Today, passkeys are supported for member users in their home tenant. With this…

Enables admins to delete both content and containers for departed users at scale thereby keeping your tenant compliant without any manual effort.

DLP policy tip support for Outlook Mobile enhances data loss prevention measures on mobile devices by providing real-time alerts to help users avoid accidentally sharing sensitive information, ensuring compliance with organizational policies.

Admin should be able to see destination machine information when end-user copy a sensitive file to a remote machine through RDP.

A new capability called Auto-Archiving for Exchange Online will enter public preview in November 2025 (currently under private preview for selected customers). When a user's mailbox utilization exceeds 95% of its quota and archive mailbox is present, this feature automatically moves the oldest items excluding…

Today, Insider Risk Management (IRM) provides policy-driven protection for data leaks, data theft, and risky AI usage. However, while policy-driven protections are powerful, customers may not always have clear visibility into where coverage can be optimized or expanded to address latent insider risk. IRM now…

To help improve label usability and configuration, the sensitivity labeling scheme will be simplified to only consist of labels and label groupings. These new label groupings allow admins to better organize and categorize their labels (previously done via parent labels).

This new capability will enable admins to scan existing files at rest in SharePoint or OneDrive for business for sensitive data.

Speed up analysis of exfiltrated content by launching Data Security Investigations (DSI) from endpoint Data Loss Prevention (DLP) alerts. In DSI, define your endpoint DLP query (for example, time range, users, and endpoints). DSI then automatically gathers the related files that triggered the alerts for…

For each enforced auto-labeling policy, admins can view how files processed during enforcement correlate to the latest simulation run. The per-policy coverage report shows volumes of files that have been labeled or are not yet labeled, and whether those files were included in the last…

Microsoft Purview network data security now integrates with Island, extending protection to Island’s browser-based workflows at the point of user interaction. With this integration, new and existing Island customers can configure Microsoft Purview collection and data loss prevention policies to detect and protect data shared…

Insights on sensitive M365 data (OneDrive and SharePoint) and recommendations on retention policies for customers to better govern their sensitive data.

Enables admins to delete both content and containers for departed users at scale thereby keeping your tenant compliant without any manual effort.

Endpoint DLP now includes a pre curated list of file extensions for the file extension condition. Previously, file extensions were entered as free form text, which could result in unsupported or non-scannable extensions being used. This could lead to gaps in protection and increase processing…

Endpoint DLP should show full path of target domain and not just the domain name in Activity Explorer.

Your organization can now manually apply Information Protection sensitivity labels in Engage. Sensitivity label support in this new application will allow admins to create labels and configure label publishing policies to determine which users and groups can manually label content in Engage. End users will…

We are expanding the access to Diagnostics beyond Global Admin to: Compliance Administrator, Security Administrator and Organization Management

With this update, Microsoft Purview will start supporting collection policies. Collection policies allow customers to scope classification (SITs - Sensitive Information Types) and activities for scoped users. We recommend reviewing collection policies as they can be created by different Purview solution admins to ensure they…

Launch a pre-scoped Data Security Investigation (DSI) from an IRM case. When a data security admin identifies a risky user who needs deeper investigation, they can launch a pre-scoped investigation directly from an IRM case, allowing them to view content analysis related to that user…

Enable aggregation of DLP alerts based on common entities user even when multiple rules are matched. This feature should consolidate related alert events into a single alert object to: Reduce alert noise, simplify investigation workflows, enhance contextual understanding of violations.

Microsoft Purview Endpoint data loss prevention is expanding coverage to Copilot + PCs initially to support Recall snapshots and determining whether policies exist to prevent capture of windows containing restricted sensitivity labels and Sensitive information types (SITs). Purview admins will author Endpoint DLP custom policies…

Enable customers to include or exclude users/user groups from Just‐In‐Time (JIT) Audit, ensuring audits are generated only for the selected users or groups.

We are updating archive file classification behavior on Windows endpoints to align with cloud workloads. This change improves consistency, reduces noise in event reporting, and enhances performance when processing archive files.

Copilot for Security in DLP can summarize DLP policies. This enhancement enables DLP admins to gain insights on coverage of policies viz. location, classifiers and notifications, and more. DLP admins can get these insights on all the policies or on few selected policies. They will…

Introducing Data lifecycle management capabilities for Microsoft Planner. Compliance admins can now create a retention policy to manage content located in Microsoft Planner such as tasks for plans associated with an Microsoft 365 Group.

The first release of Priority cleanup enables admins to create a recurring exception to delete items under a broader retention policy and/or legal hold on Exchange workload. Creating a Priority cleanup will require a separate security role, multiple approvers, and will have a complete audit…

Data Lifecycle Management (DLM) billing will be based on the volume of data retained. For example, any number of non‐Microsoft 365 generative AI prompts and responses that collectively amount to 1 GB of retained data will be billed at $0.25 per GB per month (equivalent…

This dashboard will allow admins to view the device health across all their devices to ensure the system is healthy and ready to receive policy updates and quickly identify devices that are not ready.

Enable aggregation of DLP alerts based on common entities user even when multiple rules are matched. This feature should consolidate related alert events into a single alert object to: Reduce alert noise, simplify investigation workflows, enhance contextual understanding of violations.

Enable extended 30-day backup and recovery for a tenant's Entra objects via the Microsoft 365 Backup native app or M365 Backup Storage platform APIs. This capability allows customers and ISV apps to do a point in time restore of Entra objects to a last known…

The updated identity timeline provides security teams with a single chronological view of activity and alerts associated with an identity and its linked accounts. It normalizes activity from integrated Microsoft security products, including Microsoft Entra sign-ins, Microsoft Graph audit events, SaaS and cloud activity, and…

Enhanced support for synchronizing the Security Accounts Manager account name (sAMAccountName) with Microsoft Entra Domain Services is now in Public Preview. This feature allows sAMAccountName to be populated from the onPremisesSamAccountName attribute in Microsoft Entra ID. Existing managed domains can enable the new synchronization behavior…

Default protection controls for Exchange Online is available in public preview. This release gives administrators fine-grained control to create DLP policies based on specific classification or text extraction failure types — such as timeout, throttling and other scan errors — rather than one blanket policy…

Insider Risk Management is excited to announce the ability to preview content directly within an IRM alert without having to create a case. Users with appropriate permissions will be able to preview relevant files referenced directly within activity explorer in each alert. Microsoft Purview Insider…

Adaptive Scope for SharePoint is a dynamic scoping capability in Microsoft Purview DLP that allows administrators to automatically target DLP policies to the right sites based on attributes such as site URL, site name, or custom site metadata. Unlike static scoping, which requires manually listing…

This is item is no longer accurate and we are removing it from the roadmap, we apologize for any inconvenience.

This feature in Purview Compliance Manager shall enable customers to convert complex regulations from PDF documents to actionable controls and actions in multi cloud environment. Customers can use the converted regulatory templates to create assessments and identify compliance gaps, understand and implement controls to improve…

DLP policy tip support for Outlook Mobile enhances data loss prevention measures on mobile devices by providing real-time alerts to help users avoid accidentally sharing sensitive information, ensuring compliance with organizational policies.

DLP policy tips for Microsoft Outlook for Mac provide real-time notifications to users when their email contains sensitive information that violates organizational policies. Users can see policy tips directly in the mail tip UI and have the option to remove non-compliant recipients or override the…

Policy updates in Microsoft Purview now sync faster, reducing wait times from up to 2 hours to just 30 minutes, so your protections stay up to date and take effect more quickly across your organization.

We are expanding Microsoft Purview DLP for Microsoft 365 Copilot to safeguard web searches containing sensitive data. This real-time control helps organizations mitigate data leakage and oversharing risks by preventing Microsoft 365 Copilot and Copilot Chat from using sensitive data for external web search.

DLP policy tips for Microsoft Outlook for Mac provide real-time notifications to users when their email contains sensitive information that violates organizational policies. Users can see policy tips directly in the mail tip UI and have the option to remove non-compliant recipients or override the…

This feature introduces confidence scoring and reasoning trace explainability into the Data Security Triage Agent in DLP, addressing a critical trust gap reported across multiple customers. Today, without transparency into why the agent makes a decision or how confident it is, analysts are forced to…

Data Lifecycle Management allows compliance admins to retain, review and delete content in M365 workloads. Deletion of content to adhere to compliance requirements, admins can set up Retention policies or labels. To help prevent inadvertent data loss, M365 retention labels policies and M365 retention policies…

As of today, whenever the user wants to enable email notifications the policy tips also need to be enabled and vice versa, but with this decoupling the admin can configure the following: 1) None of policy tips or email notification 2) Only policy tips 3)…

File Quarantine action in Microsoft Purview DLP for SharePoint and OneDrive, enables stronger, immediate protection for sensitive data. When a DLP policy is triggered, the File Quarantine action automatically moves the file to a restricted, admin‐controlled & defined quarantine location—instantly removing access for all users…

This release of eDiscovery features the implementation of customer-managed key (CMK) options, allowing users to manage their own encryption keys for the data included in the direct export workflow in eDiscovery, adding to the Microsoft-managed encryption already in place.

Data Security Triage Agent summaries and categorizations for DLP alerts will be made available in DLP Alerts in Microsoft Defender XDR.

This release of eDiscovery features the implementation of customer-managed key (CMK) options, allowing users to manage their own encryption keys for the data included in the direct export workflow in eDiscovery, adding to the Microsoft-managed encryption already in place.

eDiscovery users will be able to view and select SharePoint Embedded content containers owned or created by a selected person. These containers store content from apps such as Microsoft Loop, Copilot Pages, and Copilot Notebooks.

Out-of-the-box reports that contain information about all legal holds associated with eDiscovery cases in the Microsoft Purview compliance portal. Sort and filter your view based on various criteria and download the aggregated information for further analysis. Note: The status and release month has been updated…

Out-of-the-box reports that contain information about all legal holds associated with eDiscovery cases in the Microsoft Purview compliance portal. Sort and filter your view based on various criteria and download the aggregated information for further analysis.

Microsoft Purview Data Loss Prevention end-user email notification is getting advanced incident remediation capabilities: actionable email notifications. This new feature allows end users to take remediation actions directly from their mailbox, streamlining the remediation process. The end users will be able take remediation actions on…

The Advanced Review Set Explorer empowers reviewers to harness the power of real-time big data analytics on their review set data leveraging. This tool enhances data analysis by offering insights such as identifying top item types, spotting patterns, and trends within the review set. Reviewers…

Microsoft Purview Data Loss Prevention end-user email notification is getting advanced incident remediation capabilities: actionable email notifications. This new feature allows end users to take remediation actions directly from their mailbox, streamlining the remediation process. The end users will be able take remediation actions on…

The Advanced Review Set Explorer empowers reviewers to harness the power of real-time big data analytics on their review set data. This tool enhances data analysis by offering insights such as identifying top item types, spotting patterns, and trends within the review set. Reviewers can…

Granular Protections for Exchange Online is available in public preview. This release gives administrators fine-grained control to create DLP policies based on specific classification or text extraction failure types — such as timeout, throttling and other scan errors — rather than one blanket policy for…

Admin should be able to see the Endpoint DLP policy sync status on the Purview portal within 30 mins.

Reusable Lists centralize management of keywords, domains, and email addresses, eliminating duplication across rules and reducing the effort required to maintain large policies.

This release introduces a new condition for Exchange Online policies: “Count of labeled documents is greater than.” This condition evaluates the number of attachments in an email message that carry a matching sensitivity label. When the count exceeds a defined threshold, the DLP rule is…

Windows Hello for Business (WHfB) and macOS Platform SSO (macOS PSSO) can now satisfy multifactor authentication as a standalone second factor. Previously, these methods only counted as MFA during primary sign-in, and users needed a separate passkey to complete step-up prompts, Authentication Strength policies, and…

The Data Security Posture Agent is designed to expand the capacity of data security admins as they proactively work to stay on top of a dynamic data and risk landscape within their organization. Its primary job is to help discover sensitive data across your data…

Block External Domain/User action in Microsoft Purview DLP for SharePoint and OneDrive, gives organizations stronger control over who can access sensitive files. With this enhancement, admins can configure DLP policies that block file access for specific external domains or individual users. This capability helps prevent…

We are expanding Microsoft Purview DLP for Microsoft 365 Copilot to safeguard prompts containing sensitive data. This real-time control helps organizations mitigate data leakage and oversharing risks by preventing Microsoft 365 Copilot and Copilot Chat from returning a response when prompts contain sensitive data or…

The Role groups page in the Microsoft Purview compliance portal now allows admins to look up permissions by roles and memberships.

Enabling localization for the default Mark and Notify email template used in admin review and automation flows for user reported messages. This ensures end users receive review outcome notifications in their preferred language, improving understanding, trust, and participation in email reporting within Microsoft Defender for…

Microsoft Purview Adaptive Scopes will provide administrators with explicit control over lifecycle-state evaluation for recipients and site owners, helping ensure policy targeting and scope membership remain aligned with organizational requirements.

The Data Security Triage Agent in Insider Risk Management is deploying enhancements such as improved user risk and activity explorer pattern summaries to support improved investigation accuracy, context, and decision quality. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent…

Introduce an AI-powered capability leveraging Microsoft Security Copilot to automatically generate natural language explanations of changes made to DLP policies after each update within Microsoft Purview. This feature will analyze policy version deltas (pre-update vs. post-update) and produce a structured, human-readable summary that clearly explains…

AI-powered intent for classifiers: Microsoft Purview Information Protection will generate a human-readable semantic intent for custom Sensitive Information Types (SITs), helping customers better understand what their classifiers detect and refine them for higher accuracy and fewer false positives.

When DLP rules detect policy violations in Exchange Online, they generate audit records that administrators rely on for compliance monitoring, incident investigation, and policy tuning. Previously, these records only showed Sensitive Information Type matches. This feature aims to extend that to sender domain, subject keywords…

Enhance current API infrastructure to provide easy and simple way for customers to export data to integrate with SIEM tools, create automated workflows and generate customizable reports. Today alert data is present in Graph API and DLP rule match event details are present in Management…

The Microsoft Purview Data Loss Prevention policy to restrict Microsoft 365 Copilot processing sensitive files in Word, Excel, and PowerPoint will now apply regardless of file storage location.

This introduces a new DLP rule action to trigger custom Power automate workflows when a DLP rule is violated.

DLP Policy Optimizer uses AI to analyze your organization’s DLP policies, rule structure, and activity signals to identify optimization opportunities that are difficult to detect manually. It highlights overlapping rules, redundant conditions, misconfigurations, and sources of excessive noise, and presents prioritized recommendations with supporting evidence…

Microsoft Purview introduces the Classifier Simulation Mode, the first phase of the broader Classifier Health Monitoring Platform. This capability enables you to test, analyze, and optimize custom classifiers on production data before publishing them, hence offering a reliable means of verifying the effectiveness of classifiers…

Introduces enhanced controls in Content Explorer’s UI, enabling scoped visibility and filtering of SIT and label data. This will help with content discoverability and governance.

Initiate a Power Automate workflow when the item reaches the end of its retention period. For example, execute a complex disposition approval process or move the file to an archive.

Previously customers would have system files either included or excluded manually configured. With this feature there is now a capability to provide this by default and have the option of including or excluding those paths. This list is managed by Microsoft to ensure accuracy and…

With this feature, data officers can now complete their coverage story by now embedding hyperlinks within toast messages for the Edge browser. When this rule is triggered, the end user will see a toast with a customized title and message with a hyperlink. This feature…

Microsoft Purview Data Security Investigations (DSI) is extending our investigations by adding optical character recognition (OCR), extracting text from images and incorporating it into investigation data. This enables AI-powered deep content analysis to uncover data security risks that are often hidden within visual content.

This release will extend OCR support from standalone images (JPEG, JPG, PNG, BMP, TIFF, and PDF) to images embedded inside the following files and file types: Office files (XLSX, DOCX, PPTX), container files (zip, rar, 7z, and more), and PDF files. Image-only PDF files are…

As AI agents become deeply embedded in enterprise ecosystems, they are evolving beyond simple tools or workflows into a digital workforce. These agents can interpret intent, access and manipulate enterprise data, execute actions and even make real-time decisions. In many ways, they operate like human…

We're introducing notification capabilities and search improvements to Microsoft Purview Data Security Investigations. Investigators will receive notifications when key investigation events occur, such as when AI jobs complete or when new data is added to scope. Search improvements include enhanced query building to more easily…

Improves eDiscovery workflows for Loop and Copilot pages by enabling full indexing of page content for keyword search within review sets and adding HTML format support for export from search.

We’re introducing support for Insider Risk Management (IRM) alert agent summaries within Microsoft Defender, enabling investigators to access key triage insights directly in the Defender alert queue. When the IRM Triage Agent is active, IRM alerts surfaced in Microsoft Defender will now include the agent…

Endpoint DLP can now classify Office files stored in Windows devices that have Azure RMS protection applied. Classification will be triggered when file is used in applications or when just-in-time classification is enabled.

Organizations can now manually apply Purview Information Protection sensitivity labels in Engage. Allowing admins to create labels and configure label publishing policies to determine which users and groups can manually label content in Engage communities. End users in Engage will be able to then manually…

To provide more flexibility, admins can now exclude modern Microsoft 365 groups and scope sensitivity label policies to dynamic and non-mail enabled security groups—expanding policy targeting beyond individual users and mail enabled groups.

Teams meeting artifacts, including recordings, transcripts, and Loop notes, can now be configured to automatically inherit the sensitivity label from the meeting. This ensures content generated during meetings is consistently protected without requiring manual labeling, reducing risk and simplifying protection at scale.

Admins can now see the sync status of sensitivity label publishing policies directly in the Purview portal. This provides clear confirmation that label policy changes have been fully applied across Microsoft 365 workloads, reducing guesswork, speeding troubleshooting, and increasing confidence during large scale label deployments.

With this update, the indicators belonging to cloud storage apps (Box, Dropbox, Google Drive), cloud services (Azure, Amazon Web Services) and Microsoft Fabric (Power BI, Lakehouse) will be supported as triggers in Data leaks policy. With triggers, customers can define the conditions for bringing the…

Endpoint Data Loss Prevention (DLP) is changing the way archive files, such as .zip and similar container formats, are classified and enforced. This update improves detection accuracy and gives administrators finer control over how content within archives is protected.

Data Security Investigations (DSI) is introducing the ability to create custom examination focus areas. This feature will empower admins to tailor examination to their specific needs depending on the type of investigation being performed and the information they are most concerned with. This addition works…

The federatedTokenValidationPolicy is a resource type in Microsoft Graph (beta) that governs the validation of federated authentication tokens and allows customers to configure a rule to block logins where internalDomainFederation does not match UPN domain. The feature by default requires manual configuration in the tenant…

Purview enablement in AI Foundry, allows Foundry admins to activate Microsoft Purview on their subscription. Once enabled, AI interaction data from all apps and agents flows into Purview for centralized compliance, governance, and posture management of AI data.

Data Security Investigations (DSI) now further enhances its AI analysis tools, including the ability to choose between a standard categorization for potential time and/or cost savings or a more advanced categorization to include AI-generated topics. Additionally, we are making the DSI workflow faster by automatically…

The Data Security Posture Management (DSPM) Copilot Prompt Gallery is a curated collection of prompts and promptbooks created to help users engage more effectively with the Security Copilot experience in DSPM. It acts as a centralized hub where users can explore, search, and leverage prompts…

Azure AI Search now ingests Microsoft Purview sensitivity labels and enforces corresponding protection policies through built-in indexers (SharePoint, OneLake, Azure Blob, ADLS Gen2). This enables secure, policy-aligned search over enterprise data, enabling agentic RAG scenarios where only authorized documents are returned or sent to LLMs…

Introducing the ability to define how long content captured by a Communication Compliance policy is retained. Microsoft Purview Communication Compliance provides the tools to help organizations detect regulatory compliance violations (e.g. SEC or FINRA), such as sensitive or confidential information, harassing or threatening language, and…

Remotely access devices over the cloud without requiring end user involvement by signing in with credentials.

The Communication Compliance homepage will provide two columns that offer a quick overview of policy performance: the first column shows the number of scanned parent items in real time, giving visibility into scanning progress; the second column keeps you informed about parent items that meet…

Adaptive policy scopes enable your organization to create scopes that automatically updates which users to include in your policy based on geography, group, or another user attribute. The policy will automatically update to match the criteria defined in the scope instead of you constantly needing…

Adaptive policy scopes enable your organization to define user scopes for policies based on criteria such as geography, group, or other Azure Active Directory attributes. With adaptive policy scopes, policies are automatically updated to include users that match defined risk criteria rather than requiring admins…

Office for the web in Microsoft 365 supports the application of sensitivity labels with user-defined permissions.

Customers can precisely choose which AI app they should use to detect any of the Generative AI apps indicators. This is applicable to the following indicators: "Entering risky prompts in Copilot", "Receiving sensitive responses from Copilot", "Entering risky prompts in enterprise AI apps", and "Receiving…

The first release of Priority cleanup enables admins to create a recurring exception to delete items under a broader retention policy and/or legal hold on Exchange workload. Creating a Priority cleanup will require a separate security role, multiple approvers, and will have a complete audit…

With Purview enabled in Microsoft Foundry, Purview admins can setup inline DLP policies to prompts on Foundry built apps and agents to ensure data loss prevention of sensitive data.

With this update, Insider Risk Management extends its risk detection capabilities to Microsoft Fabric products by offering ready-to-use risk indicators based on activities that may lead to a data security incident in Power BI. Organizations can use these new indicators in data theft and data…

Customers can now access and review the underlying risky prompt and response interactions generated by users during AI usage, even when user anonymization is enabled within Insider Risk Management investigations. This capability ensures that anonymized investigation workflows do not limit visibility into the contextual AI…

We're adding pre-built search templates to Microsoft Purview Data Security Investigations. Templates provide pre-configured search queries for common data security scenarios, allowing investigators to scope an investigation in just a few clicks instead of manually building queries. Users select a template, provide minimal inputs (such…

We are expanding Microsoft Purview DLP for Microsoft 365 Copilot and Copilot Chat to safeguard web searches containing sensitive data. This real-time control helps organizations mitigate data leakage and oversharing risks by preventing Microsoft 365 Copilot and agents from using sensitive data for external web…

We are introducing a new URL click alert that proactively notifies security teams when a user clicks on a malicious link in Teams, helping organizations quickly identify risk and respond before further impact occurs.

Insider Risk Management is providing the ability to create a case without content. With this, we will introduce a new active case limit (2000). This new functionality will allow customers to create more cases particularly when content download is unnecessary. If a case is created…

The Data Security Triage Agent in Data Loss Prevention now offers a new sensitive data remediation function, which empowers organizations to proactively identify and remediate sensitive information—such as Social Security Numbers, passwords, and credit card data—across thousands of files stored in SharePoint or OneDrive locations…

This dashboard will allow admins to view the device health across all their devices to ensure the system is healthy and ready to receive policy updates and quickly identify devices that are not ready.

Data Security Investigations now delivers proactive AI insights within the Data Security Posture Management (DSPM) experience. When DSPM identifies potential data exfiltration, DSI automatically analyzes the flagged content against risk dimensions like intellectual property, financial data, and credentials. Results are surfaced directly in DSPM, helping…

To help improve label usability and configuration, the sensitivity labeling scheme will be simplified to only consist of labels and label groupings. These new label groupings allow admins to better organize and categorize their labels (previously done via parent labels).

Microsoft Purview Data risk assessments now support item-level investigation and remediation of SharePoint data. New insights like sensitivity label and sharing link information help users identify items at risk of oversharing. Users are empowered to remediate overshared items by resolving, notifying, applying a sensitivity label…

Monitor or protect file with unsaved sensitive content from being printed or being moved to USB or network share.

Endpoint DLP can now classify Office files stored in Windows devices that have Azure RMS protection applied. Classification will be triggered when file is used in applications or when just-in-time classification is enabled

We’re introducing cross-tenant group synchronization, a new capability that enables organizations to synchronize security groups across Microsoft Entra tenants. This feature simplifies collaboration scenarios by allowing shared access to resources across tenants while maintaining centralized group management. It also streamlines administration of multiple tenants by…

At Ignite, Microsoft is introducing a major evolution of Purview Data Security Posture Management (DSPM) to help organizations strengthen data security and confidently embrace AI. The new DSPM experience unifies visibility and control across traditional data and AI-driven environments, delivering outcome-based guided workflows that turn…

This update introduces logged-in user details (user email) on the device onboarding page for Windows devices bringing it in line with the experience for MacOS devices. Admins can now see which user is currently signed in on a device, making It faster to confirm ownership…

Account discovery provides visibility into who has access to connected applications by discovering local and orphaned accounts and identifying accounts that can be matched to Microsoft Entra ID users. Account discovery will help administrators identify access that exists outside of Microsoft Entra ID Governance and…

We’re introducing a new unified alert triage experience in Insider Risk Management that brings agent‐driven insights directly into the standard Alerts queue. With this update, analysts can view agent categorizations alongside traditional alert filters and columns in a single, consolidated workflow. The updated alert details…

A new export functionality will be introduced in two locations: the Data Loss Prevention > Policies page and the Information Protection > Label publishing policies page. This feature will allow users to export their existing DLP configurations and label policies, including schema, as a downloadable…

Data Security Investigations (DSI) is introducing a new examination focus area concentrated on identifying personal data. The personal data examination will identify and extract various types of personal data from the selected items including but not limited to, names, addresses, bank account numbers, and more…

Microsoft Purview Endpoint data loss prevention is expanding coverage to Copilot + PCs initially to support Recall snapshots and determining whether policies exist to prevent capture of windows containing restricted sensitivity labels and Sensitive information types (SITs). Purview admins will author Endpoint DLP custom policies…

The below diagnostics will help users understand which sensitive information exist in their document and what labels applied and what policies have been triggered: DLP SharePoint Diagnostics DLP EXO Diagnostics Auto labeling diagnostics for SPO/ODB

Microsoft Priva Privacy Risk Management extends its overexposure policies into data contained in Azure SQL, Azure Data Lake Storage, and Amazon S3. Organizations can create privacy policies that specify which data sources, databases, or storage buckets are in scope and Priva will automatically notify data…

Microsoft Purview Insider Risk Management variant limit is being increased from 3 to 10 per indicator and an overall limit of 100 across all indicators. Along with this, the number of items in one detection group is being increased from 200 to 500.

We are expanding Microsoft Purview Data Loss Prevention for Microsoft 365 Copilot to safeguard prompts containing sensitive data. This real-time control helps organizations mitigate data leakage and oversharing risks by preventing Microsoft 365 Copilot, including pre-built agents in Microsoft 365 Copilot, from returning a response…

The Data Security Triage Agent creates an agent-managed alert queue that identifies and prioritizes the DLP and IRM alerts that pose the greatest risk to your organization. It delivers a summary and clear explanation for why each alert was prioritized, helping analysts focus on what…

Adding below enhancements to Data Security Triage Agent in MS Purview - Metadata supported Custom Instructions (DLP only) : Earlier the agent only supported custom instructions which are related to content (E.g. Focus on alerts related to financial information). Now we also support instructions related…

A new feature will be introduced on the main Classification page, allowing users to test files against all available classifiers to identify the presence of sensitive information. Users will have the option to select a single classifier or run tests across all classifiers. This capability…

Other AI apps will move to pay-as-you-go model. Microsoft Copilot experiences indicators can still be used for free even without subscription. To continue using Other AI apps indicators, please link an Azure subscription to Microsoft Purview to enable billing. Insider Risk Management indicators transitioning to…

With this feature, data officers can now complete their coverage story by now embedding hyperlinks within toast messages for the Edge browser. When this rule is triggered, the end user will see a toast with a customized title and message with a hyperlink. This feature…

Currently admins can set Purview DLP policies to protect sensitive data from being sent to any Generative AI apps, users get blocked from sending their prompts to LLM when this is triggered and stops their workflow. This new add-on to the feature shows a new…

Microsoft Teams stores call logs in several persistent locations, such as CDR logs. Currently, these logs are retained indefinitely. However, regulatory requirements in various countries specify maximum retention periods for calling-related logs. This discrepancy creates a compliance gap, as the existing retention practices may not…

Provides access to the same device health details currently available through the export function on the device onboarding page. With the new device status API, customers can pull device-level information directly into their own BI tools, dashboards, and workflows, eliminating manual exports and making it…

Microsoft Teams now includes a capability that lets users flag calls they believe are unusual or suspicious. When a call is reported, the signal helps Microsoft strengthen security measures and reduce future unwanted or malicious call activity. This feature empowers users to actively contribute to…

Monitor or protect file with unsaved sensitive content from being printed or being moved to USB or network share.

We’re updating permissions to ensure that all roles with access to view DLP policies in Microsoft Purview can also run diagnostics on those policies. This change enhances visibility and empowers authorized users to troubleshoot and validate policy behavior more effectively. The following roles will now…

File Creation and File Modification conditions in Microsoft Purview DLP for SharePoint and OneDrive and AutoLabelling will give organizations more precise control over DLP policy definition. These conditions allow admins to configure policies based on when the files were created or last modified, enabling policies…

We are simplifying Data Security Investigations (DSI) roles following customer feedback and the continued integration with Data Security Posture Management (DSPM), Insider Risk Management (IRM), and Defender XDR. We added the Data Security Investigation Admin role to the Compliance Administrator role group. We added the…

Speed up analysis of exfiltrated content by launching Data Security Investigations (DSI) from Unified Audit Log activity. In DSI, build your audit log query by specifying criteria such as time range, activities, users, and keywords. DSI then automatically pulls the associated files into the investigation…

Insider Risk Management is releasing the ability to select multiple Data Loss Prevention (DLP) policies as triggering events in a policy. Previously, admins could only select one DLP policy as a triggering event within Insider Risk Management policies. Microsoft Purview Insider Risk Management correlates various…

Microsoft Security Store is now integrated into the Microsoft Purview DLP experience, giving admins an in‐product way to discover a curated set of integrations that extend Purview capabilities, including data security capabilities for the network. Purchasing and management are completed through Security Store, simplifying how…

Review set limit per case is increased from 20 per case to 100 per case.

Review set limit per case is increased from 20 per case to 100 per case.

Leverage policy scope insights to understand the aggregated volume of policy violations that are missed from users that are not currently scoped into the policy. Communication Compliance provides the tools to help organizations detect code of conduct and regulatory compliance violations, such as harassing or…

This feature allows users to add only a sampled subset of search results to a review set, rather than adding the entire query output. Users can configure sampling parameters—such as confidence level and sample size—to ensure the subset meets their review objectives while reducing unnecessary…

Provides access to the same device health details currently available through the export function on the device onboarding page. With the new device status API, customers can pull device-level information directly into their own BI tools, dashboards, and workflows, eliminating manual exports and making it…

Admins can now scope Purview collection policies for unmanaged cloud apps based on the presence of sensitivity labels, enabling more precise discovery of sensitive activity across inline network traffic and the Edge for Business browser. Purview DLP policies also support "URL contains text" as a…

Within Purview's Data Security Posture Management (preview), Data Risk Assessment now supports scanning all Fabric workspaces for potentially overshared Fabric data (dashboards, reports, etc.). The new Fabric tab in Data Risk Assessment allows users to view default assessment results, create custom assessments for scoped Fabric…

New enhancements for SharePoint and OneDrive enable organizations to automatically override manually applied sensitivity labels and remove labels at scale on Word, Excel, PowerPoint, and PDF files. These capabilities help ensure data remains correctly classified as policies, labels, and business requirements evolve—reducing reliance on manual…

Enable admins to configure retention policies for various Copilots and AI Apps.

This release of eDiscovery features the implementation of customer-managed key (CMK) options, allowing users to manage their own encryption keys for the data stored in eDiscovery review sets in addition to the default, strong Microsoft-managed encryption already in place.

Logical grouping of files with same schema and are under the same folder into a single file known as resource set. Using advanced resource set capability, customers can define pattern rules that will help group files based on custom patterns.

Other AI apps will move to pay-as-you-go model. Microsoft Copilot experiences indicators can still be used for free even without subscription. To continue using Other AI apps indicators, please link an Azure subscription to Microsoft Purview to enable billing. Insider Risk Management indicators transitioning to…

In this update, we are making the below enhancements to IRM exclusions to reduce alert noise. 1. Keyword logic update for email - An email will be excluded from scoring only when all the attachments match the keyword exclusions or email subject matches the keyword…

Admins will be able to select hard delete configuration while setting up a priority cleanup policy for OneDrive and SharePoint content and skip recycle bins.

A new Data Security Investigations (DSI) mitigation action, soft purge, is now available to help admins quickly and efficiently soft-delete sensitive or overshared content during investigations. Content deleted using soft purge is retained until the deleted item retention period expires, allowing admins to have further…

Purview policies like Data loss prevention (DLP) auto labelling can scan for sensitive content in most of the textual files, but images are not supported for content scanning today on Mac endpoint devices. We are adding OCR support on Mac endpoints to detect sensitive content…

Admins can perform a bulk replacement or removal of a retention label using the Purview compliance portal. They can perform the action across the entire tenant or targeted to specific content using KQL and static or adaptive scopes.

We are introducing a new Microsoft Purview RBAC role—Purview Agent Deployment—and adding it to various existing built in role groups used by analysts and admins across Purview. This change enables users who use built-in role analyst groups to deploy Security Copilot Agents in Purview without…

With this release, the file type coverage to scan, classify and protect sensitive content on Mac devices with Microsoft Purview Data Loss Prevention policies will increase from current ~40 file types to 100+ file types. This release will make the coverage of file types on…

This feature introduces Admin Unit scoping to both Content Explorer and Data Explorer, enabling more granular visibility and control over M365 data. It ensures that data exploration respects organizational boundaries defined by Admin Units, enhancing compliance and governance.

Microsoft Purview Data risk assessments now support item-level investigation and remediation of SharePoint data. Item-level insights like sensitivity label and sharing links created help users identify potentially overshared items. Users are empowered to remediate overshared items by resolving, notifying, applying a sensitivity label, or removing…

New detections are being added to Communication Compliance that enables you to build safer online environments by detecting potential hate and violence then assigning severity scores to unsafe text across languages. These classifiers are built using large language models. Microsoft Purview Communication Compliance provides the…

Admins can retrieve diagnostic 'Always-on diagnostic' traces directly from Windows endpoints and selectively upload them to Microsoft through the Purview Portal at the time of an investigation request such as submitting a support ticket, without disrupting end users or impacting their productivity. This eliminates the…

Introducing a Microsoft Purview Insider Risk Management pay-as-you-go feature usage report designed to provide transparency to the customers, enabling more accurate budget planning and policy tuning. This report provides granular breakdowns of billed processing unit usage across different data source categories and activity indicators over…

User-Based Aggregation consolidates DLP alerts by user identity i.e. a DLP rule violations, in a specified aggregation time window, of the same rule and single user will be aggregated into a single alert enabling quicker triage and remediation. Instead of reviewing alerts containing rule match…

This feature introduces the ability to classify DLP alerts directly in the Purview portal. In addition to assigning a status, customers can now categorize alerts as True Positive, False Positive, or Benign Positive. This capability helps security teams better organize, track, and manage alerts, enabling…

With this update, Insider Risk Management extends its risk-detection capabilities to Microsoft Fabric lakehouses (in addition to Power BI which is supported today) by offering ready-to-use risk indicators based on user activities in Fabric lakehouses. Organizations can use these new indicators in data theft and…

The tenant‐level process report provides eDiscovery administrators and managers with a centralized view of eDiscovery processes running across cases in the tenant—or across the cases they have access to. It surfaces key details such as process type, status, duration, timestamps, and who initiated each process…

As a Microsoft Purview user, you'll be able to view outages, service issues, and advisories that might impact your services. This new dashboard will combine the services and solutions health of Purview, Microsoft 365 services, and Azure Cloud Services in one central place in the…

We are adding to Insider Risk Management a pre-configured quick policy template to detect data theft from Microsoft Fabric and non-Microsoft 365 data sources like Box, Dropbox, Google Drive, Azure and Amazon Web Services (AWS). This will enable admins to create scenario-specific policies, with little…

With this feature when multiple files are involved in a DLP enforcement action, the policy tip will now show multiple files and their respective status.

Security admins with Defender for Office 365 Plan 1 can avail the benefits of end user reporting of Teams Messages

Security admins with Defender for Office 365 Plan 1 can utilize Zero-hour auto purge (ZAP) and admin quarantine for zapped Teams messages.

Admins can perform a bulk replacement or removal of a retention label using the Purview compliance portal. They can perform the action across the entire tenant or targeted to specific content using KQL and static or adaptive scopes.

A new Data Security Investigations (DSI) mitigation action, purge, is now available to help admins quickly and efficiently delete sensitive or overshared content during investigations, within the product UX. This addition works alongside DSI’s AI-powered content analysis features, such as categorization, AI search, and examination…

Ability to target IRM policies using global Adaptive Scopes. Adaptive scopes within IRM policies allow admins to use existing adaptive scopes created on the Microsoft Purview compliance portal within IRM policies, Adaptive scopes can be created using queries to define user groups dynamically. This feature…

Administrative units allow admins with appropriate permissions to subdivide the organization into smaller units, and then assign specific admins or role groups that can manage only the members of those units. For example, German administrators can only create/manage policies for only German users, and German…

Security admins with Defender for Office 365 Plan 2 can hunt on calls and meetings made inside Microsoft Teams for their organization

We're enhancing Activity Explorer to provide greater visibility into sensitive data flagged in Exchange Online. Previously, only the message body was viewable, which limited insight into flagged content. With this update, admins will be able to preview email attachments directly within Activity Explorer—without needing to…

We are expanding the auto-remediation capabilities in Automated Investigations and Response (AIR) to fully automate the remediation of malicious similarity clusters. Earlier this year, we introduced auto-remediation for malicious URL and file clusters. Building on that foundation, this enhancement enables AIR to automatically approve all…

We are modernizing the AIR platform for increased scalability and speed of AIR investigations to deliver the user submission playbook faster including quicker verdicts and faster resolutions.

We are introducing Advanced Agentic AI grading system integrated into the native MDO submission analysis and response workflow. This integration allows for prompt, detailed verdicts with natural language explanations when customers report phishing messages to Microsoft.

Copilot for Security is embedded in eDiscovery to enable users to provide a search prompt in natural language and will translate into keyword query language to help expedite the start of an eDiscovery search.

Security admins with Defender for Office 365 Plan 1 and above can block external users from sending messages, calls, meetings invitation over Microsoft Teams via the Tenant Allow Block List in Microsoft Defender portal. Updated January 28, 2026: We are pausing rollout at this time…

Admins or app owners can now safely pause an app’s access to Entra protected resources without deleting it or disrupting configuration. When deactivated, the app and its service principals globally (across tenants) can’t request new tokens and user sign ins are blocked, while existing tokens…

We’re excited to announce UX improvements to the DLP Alerts Portal in Purview to help you triage incidents faster and more efficiently. What’s New: 1. Unified View: Events related to each alert are now available directly on the alerts page — no need to switch…

Today, there is not a way to remove retention policies or labels (called a hold in Exchange) from items in inactive mailboxes in bulk. Now we are introducing a PowerShell cmdlet that enables retention policies or labels to be removed in bulk from these items…

Application Lifecycle Management Agent: This agent unifies the entire application lifecycle into one intelligent workflow—replacing multiple disconnected admin tasks with a single, guided experience. It automatically discovers unmanaged private apps using Global Secure Access telemetry, recommends onboarding them to Microsoft Entra, and handles setup with…

We are expanding the access to Diagnostics beyond Global Admin to: Compliance Administrator, Security Administrator and Organization Management.

Inline protections for file upload protection are directly integrated into for Edge for Business to help prevent data leakage when users upload files to consumer GenAI apps in the browser. In addition to existing text upload controls in Purview collection and DLP policies, Admins can…

Inline protections for text and file uploads, directly integrated into for Edge for Business, can be applied to more unmanaged consumer GenAI apps. Admins can now apply Purview collection policies and Purview DLP policies to detect and protect inline against sensitive data sharing in the…

AI and IT admins in Microsoft Admin Center can 1) gain visibility around oversharing risks and drive remediations 2) Understand how much of sensitive copilot interactions are protected and turn on Purview DLP for M365 Copilot right from there. Enables secure adoption of Copilot.

Currently you can create Purview Endpoint DLP policy and assign to specific users or user groups. This feature will allow you to create and assign policy based on both users and machines. You can use this feature to achieve different policies for same user on…

After further review, we continue rolling this out. We apologize for any inconvenience. This introduces the ability to exclude users and groups from IRM policies. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks such as IP theft…

With this feature, insights will be generated for potentially risky behaviors at a user level and will be surfaced across the following experiences: 1) Insider risk management context in DLP alert investigation 2) Insider risk management context in Communication compliance alert investigation 3) Insider risk…

After further review, we continue rolling this out. We apologize for any inconvenience. With this release, Insider Risk Management administrators can include or exclude specific users, groups, and adaptive scopes within policies. We are also adding support for non-mail enabled Security Groups within IRM policies…

Thai Language sentences do not have spaces in between them. And for classification purpose, we relied on right keywords to be added while creating Sensitive Information Type for ensuring accurate match. However, with this feature, spaces will be added automatically in keywords which will ensure…

In our continued efforts to enhance classification capabilities, we have added a new feature, Word-Breaker, to our existing Thai Language support in Classification. Words in Thai language sentences do not have spaces between them. And for classification purpose, we relied on the right keywords to…

With this update, Insider Risk Management will help admins identify risky AI usage. We are adding new detections of intentional and unintentional insider risk activity on generative AI apps that can pose a risk to an organization. Activities will include risky prompts containing sensitive info…

Introducing a Data Security Investigations (DSI) lightweight cost estimator designed to help analysts model and forecast both storage and compute unit costs based on specific use cases, enabling more accurate budget planning. In addition to the estimator, a new report provides granular breakdowns of billed…

Data Security Investigations (DSI) now features advanced AI analysis tools, including options to add investigative context for higher-quality results, as well as improvements in vector search relevance and content categorization to better identify risky material. Additionally, we've launched a new AI-powered search function that lets…

With this release, the file type coverage to scan, classify and protect sensitive content on Mac devices with Microsoft Purview Data Loss Prevention policies will increase from current ~40 file types to 100+ file types. This release will make the coverage of file types on…

This feature will enable users to use discovery script and json file to define compliance policy to specific organziational needs. The experience mirrors Windows and Linux custom compliance experience.

A new capability called Auto-Archiving for Exchange Online will enter public preview in November 2025 (currently under private preview for selected customers). When a user's mailbox utilization exceeds 95% of its quota and archive mailbox is present, this feature automatically moves the oldest items excluding…

This feature introduces Admin Unit scoping to both Content Explorer and Data Explorer, enabling more granular visibility and control over M365 data. It ensures that data exploration respects organizational boundaries defined by Admin Units, enhancing compliance and governance.

Introducing a capability to Purview compliance admins via a Data Lifecycle Management to bypass retention hold or legal holds to delete content on OneDrive or SharePoint Online such as Teams meeting transcripts and/or recordings earlier than the hold durations to comply with emerging compliance requirements…

Introduces enhanced controls in Content Explorer’s UI, enabling scoped visibility and filtering of SIT and label data. This will help with content discoverability and governance.

We're enhancing Activity Explorer to provide greater visibility into sensitive data flagged in Exchange Online. Previously, only the message body was viewable, which limited insight into flagged content. With this update, admins will be able to preview email attachments directly within Activity Explorer—without needing to…

Protect file based on the website the file is downloaded or the app the file is created.

This feature borrows the familiar custom permissions menu in Office and replaces the existing custom permissions UI in the Microsoft Purview Information Protection File Labeler. The new menu enables viewer, restricted editor, editor and owner permissions to be assigned to multiple groups at the same…

This update introduces logged-in user details (user email) on the device onboarding page for Windows devices bringing it in line with the experience for MacOS devices. Admins can now see which user is currently signed in on a device, making It faster to confirm ownership…

Extend Microsoft Purview Data Loss Prevention (DLP) policies and Insider Risk Management indicators to the network by integrating with your existing non-Microsoft Secure Access Service Edge (SASE) solution. This integration enables organizations to intercept and inspect traffic inline at the network layer and enforce actions…

Microsoft Purview Insider Risk Management variant limit is being increased from 3 to 10 per indicator and an overall limit of 100 across all indicators. Along with this, the number of items in one detection group is being increased from 200 to 500. Microsoft Purview…

Microsoft Purview Data Loss Prevention is extended to Microsoft 365 Copilot. This feature will allow DLP policies to provide detection of sensitivity labels in enterprise grounding data and restrict access of the content in Microsoft 365 Copilot.

With this update, IRM will support the discovery of sensitive files and text shared to any cloud application or website (inc. GenAI) via network layer. This capability is based on integration with 3rd party network partners (with data being captured via network layer). Microsoft Purview…

Launch a pre-scoped Data Security Investigation (DSI) from an IRM case. When a data security admin identifies a risky user who needs deeper investigation, they can launch a pre-scoped investigation directly from an IRM case, allowing them to view content analysis related to that user…

Microsoft Entra ID Account Recovery is an advanced authentication recovery mechanism that enables users to regain access to their organizational accounts when they've lost access to all registered authentication methods. Unlike traditional password reset capabilities, account recovery focuses on identity verification and trust re-establishment prior…

Microsoft Purview Data Loss Prevention (DLP) is extended to preventing Microsoft 365 Copilot from processing emails with sensitivity labels. This feature will allow DLP policies to provide detection of sensitivity labels in emails as enterprise grounding data and restrict access of the labeled emails in…

Delegate management and remediation authority for different people in different regions or organization units with role-based access control (RBAC). For example, German investigators should be able to investigate alerts and audit events for only German users. This update extends support to SharePoint for Microsoft 365.

This new capability further integrates SharePoint Online with Purview sensitivity labeling. SharePoint Online document library owners can set a new type of default label on the library, which automatically applies that label to all unprotected Word, Excel, PowerPoint, and PDF files within the library. This…

Insider Risk Management is releasing the ability to select multiple Data Loss Prevention (DLP) policies as triggering events in a policy. Previously, admins could only select one DLP policy as a triggering event within Insider Risk Management policies. Microsoft Purview Insider Risk Management correlates various…

Microsoft Purview Insider Risk Management (IRM) introduces the Security Copilot Alert Triage Agent in IRM that analyzes and prioritizes IRM alerts so analysts can understand and act on their most urgent alerts first. On top of prioritizing critical alerts for analysts to triage first, alert…

With this feature when multiple files are involved in a DLP enforcement action, the policy tip will now show multiple files and their respective status.

Microsoft Purview modern eDiscovery experience now enables legal and compliance teams to import non-Microsoft 365 data directly into review set as part of the modern eDiscovery workflow. This feature allows organizations to consolidate all their data into a single secure review environment for streamlined review.

Microsoft Entra ID Account Recovery is an advanced authentication recovery mechanism that enables users to regain access to their organizational accounts when they've lost access to all registered authentication methods. This feature adds additional support for protecting the account recovery flow by enabling CA policies…

Admins can use assignment filters when targeting Apple DDM policies.

OCR Cost Estimator allows you to estimate the potential cost for using Optical Character Recognition. This means that you will no longer be required to set up an Azure Subscription for billing first and can accurately estimate the cost you would have incurred while using…

This feature adds the ability to manage the password used to access the macOS recovery partition. Configuring a recovery OS password prevents users from booting company-owned devices into recovery mode, reinstalling macOS, and bypassing remote management.

Communication Compliance is improving the capabilities and customization of policy alerts. Admins will be able to customize the alert frequency per policy as well as adjust the email alerts frequency and recipients within the policy creation wizard. Microsoft Purview Communication Compliance provides the tools to…

Self-Serv Account Recovery for tenants using Passkey.Account Recovery from Total Loss using Verified ID with Face Check

Data Security Investigations (DSI) insights are now being incorporated into Data Security Posture Management to support the prevention of sensitive content exfiltration. Additionally, DSI integrations with Defender XDR and Insider Risk Management are being enhanced, reflecting customer feedback received during the Public Preview phase.

When scoping policies to Microsoft 365 Groups in Teams DLP policies, members of Teams standard and shared channel chats associated with the groups are currently protected by the policies. This change will automatically extend the protection to standard/shared channels chats in other Microsfot 365 Groups…

Windows Backup for Organizations will be generally available in Intune with controls for backing up and restoring backups in OOBE. Backup and restore experience of user settings, especially for enterprises transitioning to Windows 11.

With this release, you can use Endpoint Privilege Management elevation rules and policy to more easily manage standard users on Azure Virtual Desktop.

This improvement expands the types of elevation actions in Windows that EPM can detect and control elevation for.

Manage individual Windows quality updates including non-Security and out of band updates. Choose which update types to automatically approve and the rollout options for those approvals.

Expanded granular RBAC controls to manage Endpoint Security workloads. The ‘Security baselines’ permission previously included all security policies and now all security workloads have their own permission set

We're updating Endpoint Privilege Management to allow users who are not assigned as the primary user of a device to initiate support approval requests. Previously, these requests would fail, but with this change, they will be processed successfully.

Adminless settings able to be configured in settings catalog and account protection template.

Providing a new mode to count EDM Matches where each row is counted once in addition to the current behavior where each primary element is counted once

Windows Backup for Organizations will be generally available in Intune with controls for backing up and restoring backups in OOBE. Backup and restore experience of user settings, especially for enterprises transitioning to Windows 11.

Physical Windows devices will be attested at enrollment that enrollment credentials are stored in the hardware of the device. Administrators can view device attestations in the new Device attestation status report and manually force attestation from that report.

Intune is bringing ACME and managed device attestation support for eligible Apple devices to GA. This includes device enrollment and ADE enrollments, including AC2. This applies to new enrollments with device enrollment (BYOD) and new enrollments with ADE or Apple Configurator tool.

Enrollment time grouping for iOS/iPadOS automated device enrollment (ADE) ensures targeted apps and policies can get to devices faster and reduce latency of device setup. ETG will only be part of new iOS/iPadOS enrollment policies. Admins can add a static Entra ID group into the…

Support for visionOS and tvOS through automated device enrollment for userless enrollment with Microsoft Intune Suite including Intune Plan 2

These enrollment policies for iOS/iPadOS contains enrollment time grouping, improved UI, and removes automatic deployment of the Company Portal app and deprecated settings.

The dashboard focuses EPM insights on rollout status as well as elevations in the environment and suggestions for new rules to create.

EPM will introduce a per-rule option to run elevated apps with the original user's identity context, preserving app data, save locations, and preferences. This offers a more personalized app runtime experience compared to the default virtual account.

With this update, the generative AI apps indicators will be supported as triggers in Risky AI usage policy. With triggers, customers can define the conditions for bringing the user into the scope of a policy while the generative AI apps indicators are used to determine…

With this update, Insider Risk Management will support the discovery of sensitive files and text shared to any cloud application or website (inc. GenAI) via network layer. This capability is based on integration with 3rd party network partners (with data being captured via network layer)…

Admins can use Windows Autopilot device preparation to provision their Windows 365 Frontline shared devices.

This feature is designed to provide Audit logs for each OCR transaction; this feature is only available in Exchange and teams workload for public preview.

With this update, admins with the appropriate permissions can get tailored recommended thresholds for all the built-in indicators within the policy wizard. This feature enables organizations to fine tune their insider risk policies and get an optimal number of alerts. Microsoft Purview Insider Risk Management…

Manage individual Windows quality updates including non-Security and out of band updates. Choose which update types to automatically approve and the rollout options for those approvals.

Customers will be able to choose to leverage RBAC to authorize users for uploading data to the Exact Data Match (EDM) service instead of leveraging the EDM_DataUploaders security group for authorization.

Allow customers to bring their own user activity indicators from homegrown, SIEM/UEBA platforms, or other line-of-business applications, and leverage them in existing Insider Risk Management playbooks. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP…

With this update, IRM will start supporting collection policies. Collection policies allow customers to scope classification (SITs - Sensitive Information Types) and activities for scoped users. For device indicators based IRM policy, required collection policies will be automatically created in the background. Microsoft Purview Insider…

This feature release ‘Always-on diagnostics’, captures critical diagnostic data from onboarded endpoint devices running on macOS for EDLP issue reporting. Comprehensive trace logs will be automatically recorded and stored locally on onboarded Mac devices, eliminating the need to reproduce issues when submitting investigation requests to…

Compliance Manager now integrates with Microsoft Defender for Cloud, allowing customers to assess their compliance posture across Microsoft 365, Azure, Google Cloud Platform, and Amazon Web Services with resource-level testing and cloud-specific guidance.

Allows people to use a single device with multiple managed accounts to access company information through Teams iOS app, with Outlook to follow.

Insider Risk Management extends its detection into multicloud environments by offering ready-to-use risk indicators in Azure, AWS, and SaaS apps including Box, Dropbox, Google Drive, and GitHub. Organizations can use these new indicators in data theft and data leaks policies. Microsoft Purview Insider Risk Management…

Users of the Microsoft Authenticator app on iOS will be able to back up account names—including Microsoft work or school accounts, Microsoft personal accounts, and third-party accounts like Amazon or Google—using iCloud and iCloud Keychain. This enables secure, end-to-end encrypted backup of account names and…

Policy tuning analysis provides admins with a real-time prediction of the number of users in a tenant that could potentially match a given set of policy conditions. With this update, policy tuning analysis will support insider risk policies that are scoped for priority content. Microsoft…

Optical character recognition (OCR) scanning enables Microsoft Purview to scan images for sensitive information. With Embedded support, OCR will scan content in DOCX, PPTX, XLSX and PDFs (scanned and hybrid containing searchable text and images). This will be in addition to support for standalone images

Label-based protection support is now possible for Azure Data Lake Gen 2 and Azure Blob storage, all within Microsoft Purview information Protection. You may already know how to protect Microsoft 365 data like documents or emails with sensitivity labels, and you will now be able…

We are introducing a new Overview dashboard to help customers understand how our product effectively protects their organization environment and digital assets. The overview dashboard focuses on showcasing the effectiveness of our tools, how customers can further amplify this effectiveness and our product’s leading position…

With this update, Insider Risk Management will support the scanning technique of Optical Character Recognition (OCR) to detect potentially risky activities that may lead to data security incidents related to images in SharePoint, Teams messages, and endpoints. Microsoft Purview Insider Risk Management correlates various signals…

Remediations are script packages that can detect and fix common support issues on a user's device before they even realize there's a problem. These remediations can help reduce support calls. On demand remediations enables admins to execute a remediation on demand and as soon as…

Microsoft Purview Information Barriers v2 (IB v2) is now available for all new onboarding customers. IB v2 has enhanced architecture which enables the following new features: Large-scale segment support: The segment limit in organizations has increased to 5,000. Multi-segment support: Users can be assigned to…

This feature gives the ability for the DLP admin to rename the existing policy/rule without having to create the entire the rule or policy again.

With this new feature, user activities that could potentially result in data security incidents will be assessed more frequently within a 24-hour period compared with the current practice of once every 24 hours. Alert insights will now be updated every few hours with this increased…

SoC will be able to do submissions and tenant level block and trigger investigation actions from Advanced Hunting

Using the unified Purview portal, organizations will be able to establish a connection to their ChatGPT Enterprise workspaces to discover, collect, and store contents of interactions of users with ChatGPT Enterprise into the scope of Purview capabilities and policies.

Google to Entra Identity Sync service is a cloud-2-cloud user Identity onboarding and one way synchronization tool from Google workspace to Entra ID. This will be available as part of the M365 Admin center for Google compete customers moving into M365 to create the identities…

Your organization can now apply sensitivity labels in Microsoft Purview Information Protection to Microsoft Fabric workspaces. This new functionality will allow users to manually label Fabric items with their sensitivity level and then apply access control protections based upon the protection policies set by administrators.

Microsoft Entra ID users can now use a passkey to sign into Microsoft apps on Android devices where an authentication broker like Microsoft Authenticator or Microsoft Intune Company Portal is installed.

SecOps can now mange False positives and take move to inbox (i.e. release) quarantined messages from Threat explorer, advanced hunting, custom detection and Email entity page without the need to tab out to the Quarantine portal to take the action.