data security triage agent

The data security triage agent tag follows a Microsoft Purview Insider Risk Management enhancement focused on helping analysts interpret insider-risk alerts. The update provides clearer summaries of user risk and activity patterns, reducing the need to reconstruct an incident from thousands of isolated events. It emphasizes the investigation stage between alert generation and response, giving teams more context for understanding why an alert matters and what behavior contributed to it. The feature was listed under Microsoft 365 Roadmap ID 557683, entered preview in March 2026, and began general availability in June. Coverage also reflects its worldwide rollout status as of July 20.