MC1227618 – Microsoft Purview | Insider Risk Management – Ability to create cases without content in IRM

Product:

Purview, Purview Communication Compliance, Purview Information Protection, Purview Insider Risk Management

Platform:

Online, US Instances, Web, World tenant

Status:

In development

Change type:

New feature, Admin impact

Links:

554940

Details:

Summary:
Microsoft Purview Insider Risk Management will allow creating cases without content download, introducing a new active case limit of 2000 while keeping the content download limit at 100. This feature rolls out from late February 2026 (preview) to late June 2026 (general availability).

Details:
[Introduction]
Insider Risk Management is providing the ability to create a case without content. With this, we will introduce a new active case limit of 2000. This new functionality will allow customers to create more cases particularly when content download is unnecessary. If a case is created without content download, content download can be initiated anytime the case is active pending available content download limits. There is no change to the active content download limit of 100.
Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies based on their own internal policies, governance, and organizational requirements. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.
This message is associated with Microsoft 365 Roadmap ID 554940.
[When this will happen:]
Public Preview: We will begin rolling out late February 2026 and expect to complete by mid-March 2026.
General Availability (Worldwide, GCC, GCC-High, DoD): We will begin rolling out mid-May 2026 and expect to complete by late June 2026.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2026-02-06

updated:
2026-02-06

Public Preview Start Date

XXXXXXX ... free basic plan only

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

linked item details

XXXXXXX ... free basic plan only

Pictures

XXXXXXX ... free basic plan only

summary for non-techies**

Microsoft Purview Insider Risk Management is introducing a feature that allows the creation of up to 2000 active cases without immediate content download, with the option to download content later, and will be available for preview in February 2026 and generally available by June 2026.

Direct effects for Operations**

Increased Case Management Complexity
The ability to create cases without content may lead to an increase in the number of active cases, complicating case management and potentially overwhelming admins with more cases to monitor and manage.
   - roles: Admins, Compliance Officers
   - references: https://learn.microsoft.com/purview/insider-risk-management-activities#create-a-case-for-an-alert, https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=554940#Roadmap

Potential for Oversight in Risk Management
Creating cases without content may result in oversight of critical information, as cases could be initiated without the necessary context, leading to ineffective risk management and delayed responses to actual threats.
   - roles: Admins, Security Analysts
   - references: https://learn.microsoft.com/purview/insider-risk-management-activities#create-a-case-for-an-alert, https://purview.microsoft.com/insiderriskmgmt

Configutation Options**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only