Microsoft Purview Updates & Release Notes

In preview: Unified alert experience combines the Triage Agent and Standard alert dashboards into a single alerts list page. View and manage both classic and agent-triaged alerts from one location, with the ability to preview agent summaries, alert and user details directly on the alerts list page.

In preview: Expanded user profile details in the unified alert experience add additional user profile signals from Microsoft Entra, including office location, employee type, department, and last working date.

In preview: Expanded note capabilities across alerts and cases.

Analysts and investigators can now add and view notes on both alerts and cases.

System-generated notes are automatically applied when there's a change in alert or case status, assigned user, closure, or case escalation.

General availability (GA): Data security and compliance protections for Microsoft 365 Copilot Cowork

New

Access Endpoint DLP device attribute data using Advanced Hunting. Query Endpoint DLP device configuration and policy sync attributes at scale through the DeviceInfo table's DlpInfo column in Advanced hunting in the Microsoft Defender portal, instead of relying on point-in-time exports from the Microsoft Purview portal.

New

Create a DLP policy that uses device scoping. Scope an Endpoint DLP policy to specific device groups — for example, enforce policy only when Finance users access data from Windows devices, and not when the same users work from macOS — using dynamic device groups defined in Microsoft Entra ID.

In preview: New Email is received from > External users condition for the Microsoft 365 Copilot and Copilot Chat policy location lets DLP policies prevent Copilot from using external email as grounding data, helping reduce prompt injection risk from untrusted senders. See Block external email from being processed (preview).

In preview: Enhanced matched conditions for Exchange DLP events surfaces detailed non-sensitive information type (SIT) condition matches in DLP alerts and Activity Explorer for Exchange Online. Each matched condition includes the condition name, matched value, and source.

General availability (GA)

Email and portal notifications for Data Security Investigations. Investigators receive notifications through the Microsoft Purview Notification Center and email when setup completes and investigations are ready to use.

Updated: Data preparation in Data Security Investigations now runs automatically in the background as items are added to scope. You no longer need to manually initiate vectorization before using AI features.

New

Monitor device health with the device health reports dashboard. Use the device health reports dashboard to monitor device onboarding status, policy update readiness, and feature readiness for Endpoint DLP.

New: A new Convert supported file formats to HTML option is available when adding search results to a review set and when exporting items from a review set in eDiscovery. When enabled, cloud-native file formats such as .loop and .page files are converted to HTML, making the content indexed and keyword searchable in the review set and easier to process in post-export workflows.

In preview: View and label files with the Information Protection client using macOS.