557552 – Microsoft Purview: Data Loss Prevention – Enhancements to Data Security Triage Agent

Product:

Entra, Purview, Purview Communication Compliance, Purview Data Loss Prevention

Platform:

Web, World tenant

Status:

In development

Change type:

Links:

Details:

Adding below enhancements to Data Security Triage Agent in MS Purview - Metadata supported Custom Instructions (DLP only) : Earlier the agent only supported custom instructions which are related to content (E.g. Focus on alerts related to financial information). Now we also support instructions related to metadata. (E.g. Focus on alerts related to financial information for user Adam in last 20 days) - Consolidated Agent settings : Earlier we had seperate controls for deployment configuration and triggers. We are now merging them into a single view as the settings can be altered anytime and it becomes easier for admins and analysts to change them from single view. - Support for alerts with Non content contains condition (DLP only) : Till now we were showing alerts generated from non-content contains conditions as unsupported. (E.g. Condition = RecipientDomainIs matches and triggers alert, alert is unsupported). Now we are bringing the alerts into triage capability and determining categorization for them also - Agent Identity : Now the Triage agent can be deployed with Agent's own identity generated in Microsoft Entra. There won't be a need to have the agent run using the user's identity who was setting up the agent. This provides cleaner audit capabilities.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2026-02-20

updated:
2026-02-20

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

Microsoft Purview's Data Security Triage Agent now supports metadata-based custom instructions, consolidates settings into a single view, includes alerts for non-content-based conditions, and operates with its own identity, enhancing data monitoring and management capabilities.

Direct effects for Operations**

Data Security Management
Without proper preparation, the new metadata supported custom instructions may lead to misconfigured alerts, resulting in missed critical data loss incidents or false positives, impacting the effectiveness of data protection measures.
   - roles: Data Security Analyst, IT Administrator
   - references: https://techcommunity.microsoft.com/t5/security-compliance-identity/microsoft-purview-data-loss-prevention-dlp-enhancements/ba-p/3741230

User Experience with Alerts
The consolidation of agent settings may confuse users if not communicated properly, leading to potential delays in response to alerts and increased frustration among users who rely on timely data loss prevention measures.
   - roles: IT Support Specialist, Compliance Officer
   - references: https://techcommunity.microsoft.com/t5/security-compliance-identity/microsoft-purview-data-loss-prevention-dlp-enhancements/ba-p/3741230

Configutation Options**

XXXXXXX ... paid membership only

Data Protection**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only