Microsoft Purview: Insider Risk Management – Expanding note capabilities across alerts and cases

Microsoft Purview Insider Risk Management is enhancing alerts and cases with note-taking capabilities for better investigator collaboration and auditability. Users can add notes, and system-generated notes will track investigation events. Expanded user details and integrated Entra ID profiles improve context. Rollout begins late June 2026. What and Why: Microsoft is expanding note-taking capabilities in Microsoft Purview Insider Risk Management (IRM) alerts and cases to improve investigator collaboration and auditability. Analysts and investigators will be able to add notes directly to alerts and cases, while system-generated notes will automatically capture key investigation events such as status changes and user assignments. This enhancement helps security and compliance teams maintain a centralized investigation history, improve collaboration, and streamline insider risk investigations within a single experience. This message is associated with Microsoft 365 Roadmap ID 564620. Rollout Schedule: Public Preview: Began in late June 2026; expected to complete by mid-July 2026 General Availability (Worldwide, GCC, GCC High, DoD): Beginning in late September 20266; expected to complete by mid-October 2026 Impact on Your Organization: Who is affected: Organizations using Microsoft Purview Insider Risk Management IRM analysts, investigators, and administrators Organizations using the Alerts (preview) experience Platforms/Services: Microsoft Purview Insider Risk Management Alerts (preview) Cases Microsoft Entra ID profile integration What will happen: Users will be able to add investigation notes directly within Insider Risk Management alerts. System-generated notes will automatically record investigation events such as: Alert status changes Investigator assignments Other investigation lifecycle updates Note capabilities will also be available within Insider Risk Management Cases. Screenshot: New Notes experience in Insider Risk Management alerts showing investigator notes and automated activity tracking: View image in new tab Expanded User Details will provide investigators with additional user context directly within alerts. User details may include: Office location Employee type Department Last working date The experience will aggregate insider risk context such as: Entra ID profile information Prior alert history Prior case history Priority user group status Policy inclusion status When pseudo-anonymization is enabled, user profile attributes will remain hidden. The feature is integrated into the Insider Risk Management experience and does not require investigators to leave the alert […]

The post Microsoft Purview: Insider Risk Management – Expanding note capabilities across alerts and cases appeared first on M365 Admin.