Purview News & Roadmap
Auto-curated from the Microsoft 365 Roadmap, filtered for Purview and sorted by solution area so you can jump straight to what you work on.
Subscribe by RSSMicrosoft Purview: Introducing IRM Alert classification
Insider risk management will be introducing the ability to classify alerts as True positive, Benign (operational), and False positive. This will be available on all alerts where authorized analysts with the appropriate permissions can choose from a list of predefined classification reasons. Alert classification will help tenants to better classify risk within alerts to support reporting and tuning needs. This will replace existing dismissal reasons.
Microsoft Purview: Endpoint Data Loss Prevention-View-only access to device onboarding with the View-Only Device Management role
Microsoft Purview Data Loss Prevention is introducing more granular, role-based access to the Devices page under Settings → Device Onboarding. Previously, viewing or managing device onboarding required broad administrative roles (such as Compliance Administrator, Global Administrator, or Security Administrator). With this update, organizations can grant access using least-privilege Purview role-based access control (RBAC) roles scoped specifically to device operations. A new View-Only Device Management role enables users, such as auditors or security analysts, to view device onboarding status, search for devices, review configuration details, and export device data, without granting permission to change onboarding configuration or other administrative settings. Existing administrative roles continue to have full access, so current workflows are unaffected. This change helps organizations follow the principle of least privilege and simplifies granting read-only visibility into device onboarding without over-provisioning permissions.
Microsoft Purview: Adaptive Scope evaluation control with recipient and site owner lifecycle status
Microsoft Purview Adaptive Scopes will provide administrators with explicit control over lifecycle-state evaluation for recipients and site owners, helping ensure policy targeting and scope membership remain aligned with organizational requirements.
Microsoft Purview: Data Loss Prevention-Admin Units Support for Copilot & Cowork DLP
Microsoft Purview Data Loss Prevention is extending Administrative Units support to Microsoft 365 Copilot, Copilot Chat, and Cowork. This enables organizations to delegate management of supported Copilot DLP policies to administrators within their assigned Administrative Units, supporting regional, departmental, and regulatory boundaries without granting tenant-wide policy-management permissions. Existing tenant-wide policies continue to apply, and configuration is optional for organizations choosing to use Administrative Unit (AU)-scoped management.
One policy covers both Microsoft 365 Copilot and Cowork, so the DLP for Copilot rules you already have are what Cowork will inherit. Review them before it arrives. Cowork acts across mail, meetings and files on the user's behalf, so a gap that was harmless in a chat answer matters more here.
Review your DLP policies →Microsoft Purview: Information Protection-Auto-labeling for legacy Office files
Microsoft Purview server-side auto-labeling will support legacy Microsoft Office file formats, including Word (.doc), Excel (.xls), and PowerPoint (.ppt). Organizations can automatically evaluate and apply sensitivity labels to these files in SharePoint and OneDrive.
Microsoft Purview: Data Loss Prevention-Apply Purview network data security DLP policies to all websites, or all websites except specific cloud apps, through Entra GSA Internet Access integration
With this feature, admins can scope their network data security data loss prevention policies, integrated with Entra GSA Internet Access, to apply to all websites (.) or all websites except specific cloud apps, allowing them to apply protection to cloud apps and websites that are not in the Defender Cloud App Catalog.
Microsoft Purview: Information Protection - Apply default SharePoint library labels to data at rest
Enables auto‑labeling of existing SharePoint files to match the default sensitivity label configured on their document library. This helps organizations close labeling gaps for data at rest and ensure consistent, secure‑by‑default protection across SharePoint libraries—without relying on manual user labeling.
Microsoft Purview: Data Lifecycle Management-Graph API Support for Archive Mailboxes
Access to Archive mailboxes (Main + Auxiliary) through Microsoft Graph. The goal is to give users a single, seamless Archive view, even though Archive data may physically reside across multiple auxiliary mailboxes with EWS Graph APIs being deprecated.
Microsoft Purview: Data Lifecycle Management-Increase in expansion limit for auto-expanding archive beyond 1.5 TB
Previously, auto-expanding archive mailbox expansion was supported only up to 1.5 TB, after which mailboxes would become inoperative. Archive mailboxes can now automatically expand beyond the 1.5 TB limit, ensuring uninterrupted retention and enabling scalable archive growth as storage thresholds are reached. This capability to expand archives beyond 1.5 TB will be available to customers with eligible E5 licenses.
Microsoft Purview: Permissions audit log improvements
Improving permission checks when users access the Microsoft Purview portal. Enhanced audit logs will provide clearer visibility into role and scoped-role access decisions, helping administrators troubleshoot access issues and monitor authorization outcomes.
Microsoft Purview: Data Lifecycle Management – Ensure regulatory compliance by deleting inactive OneDrives and mailboxes for departing employees
Enables admins to delete both content and containers for departed users at scale thereby keeping your tenant compliant without any manual effort.
Microsoft Purview: Information Protection-Auto-labeling scale increase for SharePoint and OneDrive
We are increasing the maximum auto-labeling capacity for SharePoint and OneDrive from 100,000 up to 500,000 files per tenant per day. This helps organizations label and protect more of their data at rest, faster, closing labeling gaps across existing content. With sensitivity labels and protection settings applied to more files sooner, organizations can better prepare their data estate for Microsoft 365 Copilot with greater confidence.
Microsoft Purview: Information Protection-Auto-labeling per-policy coverage report
For each enforced auto-labeling policy, admins can view how files processed during enforcement correlate to the latest simulation run. The per-policy coverage report shows volumes of files that have been labeled or are not yet labeled, and whether those files were included in the last simulation snapshot. This helps admins understand enforcement progress for a specific policy against the data state captured during simulation, while also identifying files that were not found in the simulation snapshot but were processed during enforcement.
Microsoft Purview: Data Lifecycle Management-Legacy Teams retention policies covering Copilot will be treated as Teams-only
Some existing retention policies scoped to Microsoft Teams may currently also apply to Microsoft 365 Copilot interactions. As part of an upcoming change, these legacy Teams retention policies will be converted to—and treated as—Teams-only policies. They will no longer implicitly govern Copilot workloads.
Check this before it lands. If the only thing retaining Copilot prompts and responses is an old Teams retention policy, that coverage stops when the policy is converted to Teams-only, and nothing warns you. Create a dedicated retention policy for Microsoft 365 Copilot interactions first, then let the conversion happen.
Check your retention coverage →Microsoft Purview: Unified Classification Management Experience
The Unified Classification Management Experience unifies every classifier in Microsoft Purview—Sensitive Information Types (SITs), Exact Data Match (EDM), fingerprint SITs, and trainable classifiers—into one place to discover, create, validate, and manage classifiers.
Microsoft Purview: Data Loss Prevention-Upgraded inline protection for Microsoft Entra-managed apps in Edge for Business
Microsoft Purview is upgrading inline data protection for Microsoft Entra-managed apps in Edge for Business. The experience integrates with a Microsoft Entra Conditional Access grant control and simplifies configuration while removing current Purview policy restrictions. Admins can now use expanded conditions and condition combinations, multiple activities per rule, simulation mode, configurable alerts and notifications, and rule match activities are visible in activity explorer.
The roadmap item is a list of what the managed-apps path in Edge lacks today: richer conditions, more than one activity per rule, simulation mode, and Activity Explorer visibility. Preview is not until February 2027, so plan anything you deploy before then around the current limits.
Plan it in the Inline Web DLP Planner →Microsoft Purview: DSPM-Copilot Readiness and Data Explorer
We’re introducing the new readiness for Microsoft Copilot and data explorer experiences in Microsoft Purview Data Security Posture Management (DSPM). These new capabilities provide data security teams with greater visibility into their organization’s data security posture and help them assess risks, investigate findings, and prioritize remediation. The readiness for Microsoft Copilot experience in Purview DSPM helps organizations assess and improve their data readiness for Microsoft Copilot. It brings together insights into sensitive data exposure, oversharing, and protection coverage, helping security teams identify risks and assess progress toward a more secure Microsoft Copilot deployment. The new data explorer experience in Purview DSPM provides a centralized investigation experience that helps organizations understand where sensitive data exists across sites, review site-level access, and explore relevant data through preset views. It brings together sites, sensitive data, and preset views, to support more efficient investigations and reduce context switching.
Microsoft Purview: Data Loss Prevention-Expanded inline protection for unmanaged apps in Edge for Business
Microsoft Purview collection and data loss prevention (DLP) policies will support browser inline protection for a significantly broader set of unmanaged generative AI apps in Edge for Business. Admins can use existing Purview policy experiences to detect and protect sensitive data shared through supported browser activities, helping extend consistent data security controls across more destinations.
The Edge path covers a curated list of 19 AI apps today. This widens it, but until it lands any AI tool off that list needs the network path instead. Check the apps your users actually reach for against the current list rather than assuming coverage.
Plan it in the Inline Web DLP Planner →Microsoft Purview: Endpoint Data Loss Prevention-Archive File Classification Behavior Change for Windows Endpoints
We are updating archive file classification behavior on Windows endpoints to align with cloud workloads. This change improves consistency, reduces noise in event reporting, and enhances performance when processing archive files.
Microsoft Purview: Data Loss Prevention for Microsoft Cowork
Microsoft Purview Data Loss Prevention (DLP) is expanding to Microsoft Cowork, enabling data security admins to use a single policy across Microsoft 365 Copilot and Cowork. The integration helps protect sensitive AI interactions by preventing the use of labeled knowledge sources, blocking prompts that contain supported sensitive information types, and restricting sensitive prompts from being sent to Bing for web search.
One policy covers both Microsoft 365 Copilot and Cowork, so the DLP for Copilot rules you already have are what Cowork will inherit. Review them before it arrives. Cowork acts across mail, meetings and files on the user's behalf, so a gap that was harmless in a chat answer matters more here.
Review your DLP policies →Microsoft Purview: Auto-labeling scalability, policy management, and reporting enhancements
Microsoft Purview is improving auto-labeling capabilities to help organizations manage and validate labeling policies at enterprise scale. These enhancements expand support for larger SharePoint scopes, improve policy management flexibility, and provide richer visibility into auto-labeling activity.
Microsoft Purview: Data Loss Prevention – Default Protection Controls for Exchange Online in the event of classification failure
Default protection controls for Exchange Online is available in public preview. This release gives administrators fine-grained control to create DLP policies based on specific classification or text extraction failure types — such as timeout, throttling and other scan errors — rather than one blanket policy for all failure conditions.
When Purview cannot classify a message because of a timeout, throttling or another scan error, no content condition can match it. This lets you choose what happens for each failure type instead of one blanket rule. Run it in audit first to learn how often each failure happens before you block mail on it. The roadmap item lists government clouds only.
Model it in the DLP Planner →Microsoft Purview: Data Lifecycle Management – Retention for Copilot Memory
Configure retention for Microsoft 365 Copilot memory to help preserve historical versions of memory items for security, compliance, and investigation scenarios. Copilot memory includes saved memories and details inferred from chat history that enable more personalized and context-aware Copilot experiences. Copilot memory items are stored in a hidden folder in the user’s Exchange mailbox. This capability will enable retention and versioning support for inactive memory items so that administrators can maintain visibility into memory changes while active memory continues to be managed by the Copilot experience.
Microsoft Purview: Permissions audit log improvements
Improving permission checks when users access the Microsoft Purview portal. Enhanced audit logs will provide clearer visibility into role and scoped-role access decisions, helping administrators troubleshoot access issues and monitor authorization outcomes.
Microsoft Purview: eDiscovery- Select user-owned SharePoint embedded container as a data source
eDiscovery users will be able to view and select SharePoint Embedded content containers owned or created by a selected person. These containers store content from apps such as Microsoft Loop, Copilot Pages, and Copilot Notebooks.
Microsoft Purview: Information Protection-Auto-labeling per-policy coverage report
For each enforced auto-labeling policy, admins can view how files processed during enforcement correlate to the latest simulation run. The per-policy coverage report shows volumes of files that have been labeled or are not yet labeled, and whether those files were included in the last simulation snapshot. This helps admins understand enforcement progress for a specific policy against the data state captured during simulation, while also identifying files that were not found in the simulation snapshot but were processed during enforcement.
Microsoft Purview: Adaptive Scope evaluation control with recipient and site owner lifecycle status
Microsoft Purview Adaptive Scopes will provide administrators with explicit control over lifecycle-state evaluation for recipients and site owners, helping ensure policy targeting and scope membership remain aligned with organizational requirements.
Microsoft Purview: Data Loss Prevention - SLA Based Alert Reporting Dashboard
Out-of-box MTTA/MTTD/MTTR SLA Alert Reporting dashboard showing past trends, Top SITs getting exposed via DLP alerts generated. Customers can define their custom SLAs for high, med and low severity alerts and get access to dashboard showing operational performance and SLA metrics.
Microsoft Purview: Data Loss Prevention - Rule-based tagging and auto-resolution of alerts based on business needs of the customer.
Alert auto-resolution & tagging rules let you tell DLP, in advance, how to handle predictable alerts. You define a rule once, and from then on DLP applies it automatically to every new alert: ● Resolve alerts you don't need to see - e.g., Low-severity alerts for mail sent only to your trusted partner domains, so they never reach your triage queue. ● Tag alerts so you can find and route them - e.g., label every alert from your Legal department as a “Business Process”.
Microsoft Purview: Information Protection - Sensitivity Labels for Microsoft Entra Security Groups
Apply sensitivity labels to Microsoft Entra cloud security groups to extend the classification and governance you already use for Microsoft 365 groups. The same labels you publish in the Microsoft Purview portal and configure for groups and sites apply automatically to cloud security groups, with no separate label configuration required.
Container labelling reaches beyond Microsoft 365 Groups now. Remember what a container label does and does not do: it governs guest access and sharing on the container, it does not protect the content inside it. You still need labels on the files themselves.
Design your label taxonomy →Microsoft Purview: Data Loss Prevention - Data Security for non-Microsoft connected apps
Microsoft Purview Data Loss Prevention and Information Protection Auto-labeling capabilities now extend to non-Microsoft connected apps (e.g., Google Workspace, Box, Dropbox, Salesforce, ServiceNow, Amazon Web Services, and Cisco Webex). The conditions and actions supported for each of these applications vary.
Microsoft Purview: Information Protection - Auto-labeling scale increase for SharePoint and OneDrive
We are increasing the maximum auto-labeling capacity for SharePoint and OneDrive from 100,000 up to 500,000 files per tenant per day. This helps organizations label and protect more of their data at rest, faster, closing labeling gaps across existing content. With sensitivity labels and protection settings applied to more files sooner, organizations can better prepare their data estate for Microsoft 365 Copilot with greater confidence.
Microsoft Purview: Insider Risk Management - DS Triage Agent for IRM available in Defender
We’re introducing support for Insider Risk Management (IRM) alert agent summaries within Microsoft Defender, enabling investigators to access key triage insights directly in the Defender alert queue. When the IRM Triage Agent is active, IRM alerts surfaced in Microsoft Defender will now include the agent summary—such as agent categorization, investigation summary, identified risk patterns, and relevant user details—helping analysts quickly assess alert severity without leaving their existing Defender workflows. For deeper analysis, investigators can access the full IRM investigation experience within the Microsoft Purview portal.
Microsoft Purview: Data Loss Prevention - Collection and DLP Policies for Intune-Policy Managed Apps
We are introducing a new integrated Microsoft Purview Data Loss Prevention (DLP) capability for Intune Mobile Application Management (MAM)-protected mobile apps, enabling organizations to apply content‑aware protection policies to sensitive data on mobile devices. This integration ensures that clipboard actions in managed mobile apps are evaluated against Purview DLP policies before sharing is allowed, helping reduce data leakage, insider risk, and exposure to advanced threats across mobile workflows. Additionally, Microsoft Purview Collection policies can be used to govern how sensitive data is being handled in mobile apps.
Microsoft Purview: Data Loss Prevention - User Based Aggregation of DLP Alerts
Enable aggregation of DLP alerts based on common entities user even when multiple rules are matched. This feature should consolidate related alert events into a single alert object to: Reduce alert noise, simplify investigation workflows, enhance contextual understanding of violations.
Microsoft Purview: Data Lifecycle Management - Graph API Support for Archive Mailboxes
Access to Archive mailboxes (Main + Auxiliary) through Microsoft Graph. The goal is to give users a single, seamless Archive view, even though Archive data may physically reside across multiple auxiliary mailboxes with EWS Graph APIs getting deprecated by OCT 2026.
Microsoft Purview: Data Loss Prevention - Extend Purview data security to the network layer via Entra GSA integration
Extend Microsoft Purview data security controls to the network layer to detect and protect sensitive data in text and prompts by integrating with Entra Internet Access. This integration enables organizations to intercept and inspect text and AI interactions at the network layer, enforce restrictive actions based on DLP policies, and detect risky user activity through Insider Risk Management. It helps prevent sensitive data from being shared with untrusted cloud applications through browsers, apps, APIs, add-ins, and more - including generative AI platforms, social media, collaborative platforms - while managing alerts and incidents through Purview and Microsoft Defender.
This is the network-layer sibling to browser DLP, so it catches data leaving through Firefox, Chrome, or a native app rather than just Edge. The two routes are licensed differently: Entra Global Secure Access is covered by E7 or Entra Internet Access with no pay-as-you-go, while a third-party SASE needs pay-as-you-go and bills per request. Through GSA, anything Purview cannot finish inspecting is allowed through, so do not treat it as a hard wall.
What Network Data Security actually does →Microsoft Purview compliance portal: Admin assignment time limit
Microsoft Purview is introducing the ability to set a limit in days when assigning users and security groups to role groups. This allows admins to define a fixed duration when providing admin permission on a temporary basis.
Microsoft Purview: Data Loss Prevention - Data Loss Prevention to safeguard sensitive information from external web search in Microsoft 356 Copilot and Copilot Chat
We are expanding Microsoft Purview DLP for Microsoft 365 Copilot to safeguard web searches containing sensitive data. This real-time control helps organizations mitigate data leakage and oversharing risks by preventing Microsoft 365 Copilot and Copilot Chat from using sensitive data for external web search.
When Copilot searches the web, it builds a query from the prompt and sends it to Bing, outside the Microsoft 365 boundary. This lets a DLP rule stop prompts containing sensitive info types from being used for web search without blocking Copilot itself. Add it to the Copilot policy you already have rather than building a new one.
Review your DLP policies →Microsoft Purview: Data Lifecycle Management - Ensure regulatory compliance by deleting inactive OneDrives and mailboxes for departing employees
Enables admins to delete both content and containers for departed users at scale thereby keeping your tenant compliant without any manual effort.
Microsoft Purview: Data Loss Prevention - Endpoint DLP now detects sensitivity labels on files inside archives
Endpoint Data Loss Prevention (DLP) is changing the way archive files, such as .zip and similar container formats, are classified and enforced. This update improves detection accuracy and gives administrators finer control over how content within archives is protected.
Microsoft Purview: View only Role management enhancements
Microsoft Purview is introducing a new view-only role management role to give admins permissions to see all the member assignments in Purview and Defender portal. This addition will be added to Global Reader and Security Reader in Purview and Entra.
Microsoft Purview: Data Lifecycle Management - Adaptive Protection integration with Data Lifecycle Management
Adaptive Protection in Microsoft Purview helps you protect your organization’s data by integrating dynamic insider risk levels, determined by data related activities, with various policy engines to automatically moving users in and out of policies as their risk levels change over time. The integration with Data Lifecycle Management will automatically apply retention labels to preserve deleted emails and files based on a user’s insider risk level.
Microsoft Purview: Data Loss Prevention - Export DLP and Label Policy Configurations
A new export functionality will be introduced in two locations: the Data Loss Prevention > Policies page and the Information Protection > Label publishing policies page. This feature will allow users to export their existing DLP configurations and label policies, including schema, as a downloadable ZIP file. The exported file can be attached to support tickets to accelerate troubleshooting.
Microsoft Purview: Data Loss Prevention - File Testing Against Sensitive Information Classifiers
A new feature will be introduced on the main Classification page, allowing users to test files against all available classifiers to identify the presence of sensitive information. Users will have the option to select a single classifier or run tests across all classifiers. This capability is designed to help users identify sensitive content within files and troubleshoot classification issues more efficiently.
Microsoft Purview: Data Lifecycle Management - Azure PST Import
Azure PST Import is a migration method that enables PST files stored in Azure Blob Storage to be imported directly into Exchange Online mailboxes. It follows the standard two‑step Exchange Migration Service pattern: an initial analysis phase to validate and assess PST data, followed by execution of the actual migration. The process also involves creating a migration endpoint, running an analysis-only migration batch, using the analysis results to configure the final batch, and then starting the batch to import PST content into target mailboxes.
Microsoft Purview: Data Lifecycle Management - Retention capabilities based on files Last Accessed in OneDrive and SharePoint
Ability to apply Retention labels and policies to items on OneDrive and SharePoint based on when the items were last accessed by an user.
Microsoft Purview: Endpoint Data Loss Prevention - Protect sensitive data over FTP and SFTP with Endpoint DLP
Endpoint DLP support for FTP and SFTP enables organizations to monitor and protect sensitive data transferred from managed endpoints using FTP and SFTP, helping prevent unauthorized data exfiltration while maintaining visibility and control.
Microsoft Purview: eDiscovery - CMK (Customer managed key) for eDiscovery direct export
This release of eDiscovery features the implementation of customer-managed key (CMK) options, allowing users to manage their own encryption keys for the data included in the direct export workflow in eDiscovery, adding to the Microsoft-managed encryption already in place.
Microsoft Purview: Data Security Triage Agent - Sensitive Data Remediation through Microsoft Teams
The Data Security Triage Agent in Data Loss Prevention now offers a new sensitive data remediation function, which empowers organizations to proactively identify and remediate sensitive information—such as Social Security Numbers, passwords, and credit card data—across thousands of files stored in SharePoint or OneDrive locations, dramatically increasing the percentage of remediated files with sensitive information, resulting in reduced compliance risk. Seamlessly integrated with Microsoft Purview, this new agent function automatically detects file(s) with a Data Loss Prevention (DLP) policy match “Needs Attention” alerts and pushes a remediation notification to the end user who last modified the file guiding them to remove sensitive data through targeted Microsoft Teams messages. Its’ closed-loop workflow ensures that remediation progress is tracked and confirmed, giving admins real-time visibility and control via the Data Security Posture Management dashboard. By streamlining sensitive data cleanup and automating user engagement, this agent helps organizations achieve their remediation goals at scale. Let the Data Security Triage Agent handle the heavy lifting of pushing remediation requests directly to the end user, so Purview admins don't have to!