560597 – Microsoft Purview: Data Security Triage Agent in Data Loss Prevention – Reasoning Trace and Confidence Score for agent-triaged alerts

Product:

Purview, Purview Data Loss Prevention

Platform:

Web, World tenant

Status:

In development

Change type:

Links:

Details:

This feature introduces confidence scoring and reasoning trace explainability into the Data Security Triage Agent in DLP, addressing a critical trust gap reported across multiple customers. Today, without transparency into why the agent makes a decision or how confident it is, analysts are forced to fall back to manual review — completely negating the automation value. The feature will surface a reasoning trace alongside each agent decision and a confidence score, giving analysts a clear signal of how reliable the agent's output is. This provides SOC teams with an auditable, explainable output they can validate rather than blindly trust, enabling them to progressively increase reliance on automation over time.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2026-04-24

updated:
2026-04-24

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Lack of Transparency in Decision Making
Without proper preparation for the new confidence scoring and reasoning trace features, analysts may struggle to understand the rationale behind agent decisions, leading to confusion and potential misinterpretation of alerts.
   - roles: Security Analysts, Data Protection Officers
   - references: https://techcommunity.microsoft.com/t5/security-compliance-identity/microsoft-purview-data-security-triage-agent-in-data-loss/ba-p/3741230

Increased Manual Review Workload
If the new features are implemented without adequate training or preparation, analysts may revert to manual reviews due to distrust in the automated outputs, negating the efficiency gains intended by the automation.
   - roles: Security Analysts, IT Operations Managers
   - references: https://techcommunity.microsoft.com/t5/security-compliance-identity/microsoft-purview-data-security-triage-agent-in-data-loss/ba-p/3741230

Configutation Options**

XXXXXXX ... paid membership only

Data Protection**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only