MC1255406 – Microsoft Purview | Data Security Triage Agent Summaries for DLP Alerts in Microsoft Defender XDR

Product:

Defender, Defender XDR, Purview, Purview Communication Compliance, Purview Data Loss Prevention

Platform:

Online, Web, World tenant

Status:

In development

Change type:

New feature, Admin impact

Links:

558860

Details:

Summary:
Microsoft Defender XDR will integrate AI-generated summaries and categorizations for DLP alerts via the Microsoft Purview Data Security Triage Agent, improving alert triage. Deployment starts April 2026 (preview) and August 2026 (general). Agent management remains in Purview; DLP policies and user impact remain unchanged.

Details:
[Introduction]
We're introducing Data Security Triage Agent summaries and categorizations for Data Loss Prevention (DLP) alerts directly within the Microsoft Defender XDR portal. This update helps security analysts triage DLP alerts more efficiently by surfacing AI-generated summaries and categorizations created by the Microsoft Purview Data Security Triage Agent.
Screenshot 1: Data Security Triage Agent outputs and summaries now available in DLP alerts in Microsoft Defender XDR

This message is associated with Roadmap ID 558860.
[When this will happen:]
Public Preview: We will begin rolling out early April 2026 and expect to complete by mid-April 2026.
General Availability (Worldwide): We will begin rolling out mid-August 2026 and expect to complete by late August 2026.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2026-03-19

updated:
2026-03-19

Public Preview Start Date

XXXXXXX ... free basic plan only

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

linked item details

XXXXXXX ... free basic plan only

Pictures

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

AI Integration in DLP Alerts
Without proper preparation, the integration of AI-generated summaries may lead to misinterpretation of alerts by analysts, causing delays in incident response.
   - roles: Security Analysts, IT Administrators
   - references: https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=558860

User Training and Familiarization
If analysts are not trained on the new features, they may struggle to utilize the AI-generated summaries effectively, leading to inefficient alert triage.
   - roles: Security Analysts, IT Trainers
   - references: https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=558860

Change Management
Failure to update internal documentation regarding the new triage experience may result in confusion and inconsistent practices among security teams.
   - roles: Security Analysts, IT Documentation Specialists
   - references: https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=558860

Permissions and Role Assignments
If role assignments are not reviewed prior to deployment, analysts may lack the necessary permissions to deploy the Data Security Triage Agent, hindering their ability to respond to alerts.
   - roles: IT Administrators, Security Analysts
   - references: https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=558860

Compliance Monitoring
Without preparation, the new AI capabilities may complicate compliance monitoring processes, as analysts may not be familiar with the changes in DLP alert investigations.
   - roles: Compliance Officers, Security Analysts
   - references: https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=558860

Configutation Options**

XXXXXXX ... paid membership only

Opportunities**

XXXXXXX ... free basic plan only

Potentional Risks**

XXXXXXX ... paid membership only

Data Protection**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

Hypothetical Work Council Statement**

XXXXXXX ... paid membership only

DPIA Draft**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only