558548 – Microsoft Purview: Data Security Investigations – analyze files tied to audit log activities

Product:

Purview

Platform:

Web, World tenant

Status:

In development

Change type:

Links:

Details:

Speed up analysis of exfiltrated content by launching Data Security Investigations (DSI) from Unified Audit Log activity. In DSI, build your audit log query by specifying criteria such as time range, activities, users, and keywords. DSI then automatically pulls the associated files into the investigation (for example, UserA downloaded a file on 3/1/2026).

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2026-03-13

updated:
2026-03-13

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

Microsoft Purview's Data Security Investigations (DSI) helps quickly identify key data security incidents by using the Unified Audit Log to filter and gather relevant files based on specific criteria, streamlining the investigation process.

Direct effects for Operations**

Data Security Investigation Implementation
Without proper preparation, the implementation of Data Security Investigations may lead to incomplete or inaccurate audit log queries, resulting in missed critical data breaches or security incidents.
   - roles: IT Security Analyst, Compliance Officer
   - references: https://techcommunity.microsoft.com/t5/security-compliance-identity/microsoft-purview-data-security-investigations/ba-p/3651230" target="_blank" rel="nofollow noopener noreferrer">https://techcommunity.microsoft.com/t5/security-compliance-identity/microsoft-purview-data-security-investigations/ba-p/3651230, https://www.microsoft.com/en-us/security/blog/2023/01/10/introducing-microsoft-purview-data-security-investigations/ " target="_blank" rel="nofollow noopener noreferrer">https://www.microsoft.com/en-us/security/blog/2023/01/10/introducing-microsoft-purview-data-security-investigations/

User Experience Disruption
If the change is implemented without adequate training or communication, users may experience confusion or frustration when accessing or utilizing the new Data Security Investigations features, leading to decreased productivity.
   - roles: End User, IT Support Specialist
   - references: https://www.microsoft.com/en-us/security/blog/2023/01/10/introducing-microsoft-purview-data-security-investigations/, https://techcommunity.microsoft.com/t5/security-compliance-identity/microsoft-purview-data-security-investigations/ba-p/3651230" target="_blank" rel="nofollow noopener noreferrer">https://techcommunity.microsoft.com/t5/security-compliance-identity/microsoft-purview-data-security-investigations/ba-p/3651230

Configutation Options**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only