486827 – Microsoft Purview: Insider Risk Management – Data Security Investigation integration

Product:

Purview, Purview Communication Compliance, Purview compliance portal, Purview Information Protection, Purview Insider Risk Management

Platform:

Web, World tenant

Status:

Launched

Change type:

Links:

MC1091445

Details:

Launch a pre-scoped Data Security Investigation (DSI) from an IRM case. When a data security admin identifies a risky user who needs deeper investigation, they can launch a pre-scoped investigation directly from an IRM case, allowing them to view content analysis related to that user and better assess post-incident data impact.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability

Created:
2025-03-27

updated:
2026-01-21

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Please, look at the most relevant linked item for details

explanation for non-techies**

Imagine you are managing a team of detectives working on a complex case. You have various tools and resources at your disposal to help you solve the mystery. In the world of IT and data security, Microsoft Purview Compliance Portal acts like your detective toolkit, specifically designed to help you manage insider risks and protect sensitive information.

When a data security administrator, akin to a lead detective, identifies a user who might be involved in suspicious activities, they need to delve deeper into the situation. This is where the integration of Data Security Investigation (DSI) with Insider Risk Management (IRM) comes into play. Think of it as being able to quickly pull up a detailed dossier on a suspect directly from your case files. This allows the administrator to launch a focused investigation, examining the user's actions and communications to understand the full extent of any potential data breach or misuse.

This integration is like having a magnifying glass that zooms in on specific areas of interest, providing clarity and insight into the user's behavior. By analyzing the content related to the user, the administrator can better assess the impact of any incident, much like a detective piecing together evidence to understand the full story.

Overall, this feature helps streamline the investigation process, making it easier for data security teams to protect their organization's information and respond effectively to potential threats. It's about having the right tools to ensure that when something suspicious occurs, you can quickly and efficiently get to the bottom of it, just like a well-prepared detective solving a case.