MC1244281 – Microsoft Purview | Insider Risk Management – Ability to preview content in Insider Risk Management Alerts

Product:

Exchange, OneDrive, Purview, Purview Communication Compliance, Purview Information Protection, Purview Insider Risk Management, SharePoint

Platform:

Online, US Instances, Web, World tenant

Status:

In development

Change type:

New feature, User impact, Admin impact

Links:

557189

Details:

Summary:
Microsoft Purview Insider Risk Management will add a content preview tab in alerts, allowing investigators to view supported SharePoint, OneDrive, and Exchange content without creating cases. Rolling out April to July 2026, this feature is enabled by default for licensed tenants and requires no action to enable.

Details:
[Introduction]
We're adding the ability to preview content directly within Insider Risk Management (IRM) alerts in Microsoft Purview. This enhancement removes the need to create a case to view potentially risky content, helping investigators quickly evaluate alerts and accelerate triage. This feature aligns with customer feedback requesting faster, more streamlined investigation workflows.
This message is associated with Microsoft 365 Roadmap ID 557189.
[When this will happen:]
Public Preview: Rolling out in early April 2026 and expected to complete by late April 2026.
General Availability (Worldwide, GCC, GCC‑High, DoD): Rolling out in mid‑June 2026 and expected to complete by late July 2026.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2026-03-05

updated:
2026-03-05

Public Preview Start Date

XXXXXXX ... free basic plan only

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

linked item details

XXXXXXX ... free basic plan only

Pictures

XXXXXXX ... free basic plan only

summary for non-techies**

Microsoft is adding a feature to its Purview Insider Risk Management tool, available from April to July 2026, allowing investigators to preview content from alerts without creating a case, streamlining the investigation process for those with the appropriate permissions.

Direct effects for Operations**

Content Preview Feature Implementation
If the content preview feature is implemented without proper preparation, investigators may face confusion regarding the new workflow, leading to potential delays in investigations and mismanagement of alerts.
   - roles: Investigators, Security Operations Team
   - references: https://learn.microsoft.com/purview/insider-risk-management-activities#activity-explorer-tab, https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=557189

Internal Workflow Adjustments
Failure to update internal investigation workflows or playbooks to incorporate the new content preview feature may result in inefficient investigation processes and missed opportunities for timely risk assessment.
   - roles: Compliance Teams, Investigators
   - references: https://learn.microsoft.com/purview/insider-risk-management-activities#activity-explorer-tab, https://sip.purview.microsoft.com/insiderriskmgmt/overviewpage

Configutation Options**

XXXXXXX ... paid membership only

Data Protection**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only