564620 – Microsoft Purview: Insider Risk Management – Expanding note capabilities across alerts & cases

Product:

Purview, Purview Communication Compliance, Purview Insider Risk Management

Platform:

US Instances, Web, World tenant

Status:

In development

Change type:

Links:

Details:

We’re introducing a new collaboration capability in Insider Risk Management that enables analysts and investigators to add notes directly within alerts. With this feature, users can document investigation progress, share findings, and capture key context throughout the triage process. In addition to manually added notes, system‑generated notes will automatically record updates such as alert status changes or user assignments — helping teams maintain a clear and auditable investigation timeline. By centralizing investigation history directly within alerts, this update helps improve collaboration and ensures all stakeholders stay aligned throughout the investigation lifecycle. These note enhancements will also be made available in Cases. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies based on their own internal policies, governance, and organizational requirements. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2026-05-28

updated:
2026-05-28

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Collaboration Inefficiencies
Without proper preparation, the new note capabilities may lead to confusion among analysts if they are not trained on how to effectively use the new features, resulting in miscommunication and delays in investigations.
   - roles: Analysts, Investigators
   - references: https://techcommunity.microsoft.com/t5/security-compliance-identity/microsoft-purview-insider-risk-management/ba-p/3651230

Data Integrity Risks
If the new note-taking feature is implemented without adequate testing, there may be risks of data loss or corruption, which could compromise the integrity of investigation records and lead to incorrect conclusions.
   - roles: Data Analysts, Compliance Officers
   - references: https://techcommunity.microsoft.com/t5/security-compliance-identity/microsoft-purview-insider-risk-management/ba-p/3651230

Configutation Options**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only