What Microsoft says is coming
Insider Risk Management (IRM) alerts will get a classification step. Authorized analysts will mark an alert as one of three outcomes:
- True positive
- Benign (operational)
- False positive
Analysts will pick from a list of predefined reasons. Microsoft says this applies to all alerts. The stated goal is to help tenants classify risk within alerts for reporting and tuning. The feature will replace the existing dismissal reasons.
The roadmap entry lists these details:
| Item | Roadmap entry |
|---|---|
| Product | Microsoft Purview (web) |
| Preview | November 2026 (estimated) |
| General availability | January 2027 (estimated) |
| Clouds | Worldwide (Standard Multi-Tenant), GCC, GCC High, DoD |
Microsoft's roadmap notes that all information is subject to change. The entry gives no day-level dates and no separate timing for each cloud.
What exists today
The change makes more sense next to the current triage model. Microsoft Learn describes four alert statuses:
- Confirmed: The alert is confirmed and assigned to a new or existing case. The current documentation says an analyst can confirm an alert into a new or existing case, or dismiss it.
- Dismissed: The alert was dismissed as benign. The analyst can add a reason and notes for future reviewers. The documented reason choices are "Activity is expected for this user," "Activity is impactful enough for me to investigate further," and "Alerts for this user contain too much activity."
- Needs review: No triage action has been taken yet.
- Resolved: The alert belongs to a closed, resolved case.
Today's dismissal reasons are a mixed bag. One says the activity is expected. Another says the activity is impactful enough to investigate further. A third is effectively a tuning complaint about alert volume. The new scheme appears to separate the judgment about the alert from the operational reasons behind it.
That is my reading, not Microsoft's statement. The roadmap doesn't say which predefined reasons will appear. It also doesn't say whether the "too much activity" style of feedback survives in some form.
Why admins and analysts should care
IRM already has alert reports. Microsoft documents them as covering alert volumes, progress in managing alerts, common alert sources and time spent triaging. They can be filtered by All, Confirmed or Dismissed alerts. One report type is "Dismissal reasons."
Consistent three-way outcomes could make that reporting more meaningful. A "Dismissed" alert can mean anything from a genuinely harmless event to simple noise. Separating benign operational from false positive could help a compliance lead see two things:
- Where a policy is catching legitimate business activity, such as a finance team that routinely moves files.
- Where a policy is simply wrong.
Those call for different fixes: scoping or exclusions in one case, detection tuning in the other. This is analysis, not a documented feature. Microsoft hasn't said how reports, filters or dashboards will change.
The Defender XDR wrinkle
IRM alerts also appear in the Microsoft Defender portal, and the two products use different frameworks. Microsoft's documentation currently maps them this way:
| Defender classification | Purview IRM classification |
|---|---|
| True positive | Confirmed |
| Information, expected activity (benign positive) | Dismissed |
| False positive | Dismissed |
Microsoft says classification and other updates sync between the portals within 30 minutes. Defender's Resolved status depends on classification. If no classification is supplied, the Purview side defaults to Dismissed.
Today, then, two Defender outcomes collapse into one Purview status. A native three-way classification in Purview looks like a natural match for Defender's three outcomes. Microsoft has not said how the new categories will map to Defender, or whether the sync will change. SOC teams that run IRM alerts through Defender should watch for that detail.
Purview's DLP alerts are a precedent. Microsoft's Message Center post MC1169572, as aggregated by a community tracker, describes a DLP classification property. Its values are True Positive, False Positive, Benign Positive or Not Set, and it syncs with Defender. That suggests Microsoft is steering Purview toward Defender-style vocabulary. It doesn't tell us the IRM design, which uses different wording ("Benign (operational)").
Permissions
The roadmap says only that "authorized analysts with the appropriate permissions" can classify. Current documentation says these role groups can access and investigate alerts:
- Insider Risk Management
- Insider Risk Management Analysts
- Insider Risk Management Investigators
Role group changes can take up to 30 minutes to apply. Administrative units can also scope who sees which alerts. Don't assume the new classification will follow exactly this permission model. Microsoft hasn't confirmed it.
What to do now
- Document your current dismissal reasons. Note how your analysts use them today. That gives you a baseline for comparison once the new classifications arrive.
- Check your reporting. If you export the Dismissal reasons report or build processes around it, expect to review them when the change lands. Microsoft hasn't said what happens to historical data.
- Review role group membership. Make sure the right people hold analyst and investigator roles.
- Plan training. Agree internally on what counts as "benign operational" versus "false positive" before the labels exist. Otherwise the new categories will be applied inconsistently, and reporting will suffer.
- Watch the Message Center. Preview is estimated for November 2026. Microsoft usually posts details there as rollouts approach.
- If you use Defender XDR or Sentinel integrations, note the existing classification mapping and test any automation once the feature appears.
What we don't know
- The full list of predefined reasons
- Whether classifications can be edited after they're set
- How existing alerts and historical reports will be treated
- Whether classification affects severity, case creation or policy behavior
- How the new categories map to Defender
- Exact rollout dates within the estimated months
The bottom line
This looks like a modest but useful change. It improves how analysts record their conclusions and how administrators read the results. It isn't a detection improvement. Alert generation, risk scoring and severity stay as they are. Better labels only help if analysts apply them consistently, and the trade-off is a change to existing dismissal-reason workflows. Expect a preview in November 2026 and general availability in January 2027, subject to Microsoft's usual caveats.