Microsoft Purview | Insider Risk Management triage agent summaries available in Microsoft Defender

Microsoft Purview Insider Risk Management triage agent summaries will appear in Microsoft Defender alerts, providing AI-generated insights to streamline investigations. This feature rolls out from mid-August to December 2026, enabling easier alert review without changing existing configurations. No action is needed if prerequisites are met. What and why We’re introducing Insider Risk Management (IRM) triage agent summaries in Microsoft Defender. This enhancement helps investigators review key risk insights directly from the Defender alert queue, reducing the need to switch between security tools during alert triage. When the IRM triage agent is enabled and Insider Risk Management alerts are shared with Microsoft Defender, supported alerts will include AI-generated summaries such as alert categorization, investigation findings, observed risk patterns, and relevant user context. Investigators can continue to access the complete investigation experience in Microsoft Purview for deeper analysis. This message is associated with Microsoft 365 Roadmap ID 567472. Rollout schedule Public Preview: Beginning in mid-August 2026 and expected to complete in early September 2026 General Availability (Worldwide): Beginning in early December 2026 and expected to complete in late December 2026  Impact on your organization Who is affected Organizations that share Microsoft Purview Insider Risk Management alerts with Microsoft Defender Organizations that have the IRM triage agent enabled and active Security analysts and investigators who review Insider Risk Management alerts in Microsoft Defender Platforms and services Microsoft Defender Microsoft Purview Insider Risk Management Web What will happen Supported Insider Risk Management alerts in Microsoft Defender will display IRM triage agent summaries:  View image in new tab Summaries may include alert categorization, investigation findings, identified risk patterns, and relevant user context. The feature will be enabled automatically for organizations that meet the prerequisites. Existing alert-sharing configurations between Insider Risk Management and Microsoft Defender will be preserved. There is no impact to existing configurations or workflows. After rollout, investigators can: Review Insider Risk Management alerts in Microsoft Defender. Access the full investigation experience in Microsoft Purview when needed. Action required and recommendations: No action is required if your organization already meets the prerequisites. Review the following to ensure readiness: Confirm that Insider Risk Management alerts are […]

The post Microsoft Purview | Insider Risk Management triage agent summaries available in Microsoft Defender appeared first on M365 Admin.