Microsoft has marked agent-focused Insider Risk Management capabilities in Microsoft Purview as launched, extending its compliance monitoring from human users to AI agents that can access data, call tools, and act across enterprise systems. Microsoft 365 Roadmap item 516032 was updated on July 13, 2026, with general availability dated June 2026 for worldwide standard multi-tenant environments.
The rollout gives security and compliance teams agent-specific indicators, risk scoring, policies, and investigation workflows rather than treating autonomous software as an ordinary user account. Microsoft’s documentation describes the feature as a way to detect risky prompts, sensitive responses, unusual data access, and other agent activity that could lead to data exposure or policy violations.
There is, however, an important status wrinkle. The roadmap now says Launched, while some Microsoft Learn documentation still calls the associated Risky Agents policy a preview feature. The roadmap description also retains an older January 30 note saying development was targeting April 2026, despite listing general availability in June. Administrators should therefore verify what is enabled in their own Purview tenant rather than relying on any single status label.
Insider Risk Management has traditionally correlated activity signals to identify threats such as intellectual property theft, data leakage, and security-policy violations involving employees and other users. The agent expansion applies that model to software capable of interpreting instructions, retrieving enterprise information, generating content, and executing actions.
That distinction matters because an agent can create insider-like risk without malicious intent. A poorly scoped agent might retrieve sensitive SharePoint content, place confidential details in a response, follow an unsafe prompt, or use a tool that sends information beyond the organization’s approved boundary.
The speed and persistence of automation also change the potential impact. A human might open or share several files before an alert is reviewed; an agent could process a much larger collection during a single workflow. Traditional identity controls remain necessary, but they do not necessarily explain whether the agent’s behavior was appropriate in context.
Microsoft’s approach is to assign risk based on agentic activities and then bring the resulting alerts into the established Insider Risk Management workflow. Analysts can review the observed activity, examine its context, determine whether it represents an actual incident, and escalate the matter through existing compliance processes.
According to Microsoft Learn, the Risky Agents policy detects activity including:
That separation should help investigators avoid forcing agent events into a user-centric model. It also gives administrators a place to inspect policy health, active alerts, confirmed alerts, and the effectiveness of actions taken against agent-related detections.
The built-in Risky Agents policy is designed to provide initial coverage without requiring every organization to construct a policy from scratch. Microsoft says it appears automatically for organizations with supported licensing and can begin generating alerts from observed agent activity.
Organizations can still build custom policies when the default detections do not match their internal governance requirements. That will be particularly relevant for enterprises where agents have specialized roles, such as processing financial records, assisting developers, interacting with customer data, or operating across regulated repositories.
A baseline anomaly may carry very different significance depending on the agent. A customer-service agent unexpectedly reading engineering files is more suspicious than a knowledge-management agent accessing the same location. Conversely, an agent designed for broad enterprise search may require tighter controls around what it can reproduce or share rather than simple alerts based on access volume.
Agent risk calculated in Insider Risk Management can also be shared with Microsoft’s Data Security Posture Management for AI and surfaced through the Microsoft 365 admin center. This points to a broader strategy in which Purview supplies the data and compliance signals while other Microsoft management surfaces provide organization-wide visibility.
Yet Microsoft’s detailed monitoring page still calls Risky Agents a preview policy. The policy template documentation uses the same preview designation, even as the broader roadmap item is categorized as generally available.
This could reflect a documentation lag, a staged transition in which the underlying agent indicators have reached general availability while a particular template remains in preview, or differences between supported agent platforms. Microsoft has not clarified that distinction in the roadmap entry.
For administrators, tenant evidence should take priority over roadmap wording. Before depending on the capability for a compliance requirement, teams should confirm that the Agent policy view is present, determine which agent types are producing signals, test whether expected activity generates alerts, and check the licensing terms applied to the tenant.
The distinction between availability and coverage is equally important. A feature can be generally available while still monitoring only a subset of an organization’s agent estate. Enterprises increasingly deploy agents from multiple vendors and frameworks, alongside custom automation that may not identify itself as an agent to Microsoft’s services.
Microsoft’s own training material warns that Purview coverage varies across agent types and that some agents behave differently from users in ways that can create policy gaps. Inventorying agents and validating telemetry will therefore be a prerequisite for meaningful risk management, not an optional cleanup task after policies are enabled.
Agent monitoring nonetheless introduces new governance questions. An alert may involve the agent, the user who issued a prompt, the identity under which a connector operated, the developer who configured the workflow, and the owner of the accessed data. Responsibility may be distributed across several teams even when Purview presents the incident as one sequence of risky activity.
Compliance teams will need procedures for distinguishing between malicious use, unsafe agent configuration, excessive permissions, and an inaccurate detection. They will also need to decide when an alert is a user conduct issue and when it is fundamentally an engineering or access-control problem.
Purview’s risk score can prioritize an event, but it cannot replace those organizational decisions. A high-risk response generated from sensitive data might demand immediate containment, while unusual access by a newly deployed indexing agent could be expected behavior that was never documented for investigators.
The practical milestone is no longer simply switching on an agent policy. It is proving that the organization knows which agents exist, which identities and tools they use, what data they are permitted to touch, and whether Purview can see enough of that activity to raise a useful alert. Roadmap item 516032 moves Microsoft closer to that goal, but the mixed preview and general-availability labeling makes tenant-level validation the first task for administrators.
The rollout gives security and compliance teams agent-specific indicators, risk scoring, policies, and investigation workflows rather than treating autonomous software as an ordinary user account. Microsoft’s documentation describes the feature as a way to detect risky prompts, sensitive responses, unusual data access, and other agent activity that could lead to data exposure or policy violations.
There is, however, an important status wrinkle. The roadmap now says Launched, while some Microsoft Learn documentation still calls the associated Risky Agents policy a preview feature. The roadmap description also retains an older January 30 note saying development was targeting April 2026, despite listing general availability in June. Administrators should therefore verify what is enabled in their own Purview tenant rather than relying on any single status label.
Purview Starts Treating Agents as Insiders
Insider Risk Management has traditionally correlated activity signals to identify threats such as intellectual property theft, data leakage, and security-policy violations involving employees and other users. The agent expansion applies that model to software capable of interpreting instructions, retrieving enterprise information, generating content, and executing actions.That distinction matters because an agent can create insider-like risk without malicious intent. A poorly scoped agent might retrieve sensitive SharePoint content, place confidential details in a response, follow an unsafe prompt, or use a tool that sends information beyond the organization’s approved boundary.
The speed and persistence of automation also change the potential impact. A human might open or share several files before an alert is reviewed; an agent could process a much larger collection during a single workflow. Traditional identity controls remain necessary, but they do not necessarily explain whether the agent’s behavior was appropriate in context.
Microsoft’s approach is to assign risk based on agentic activities and then bring the resulting alerts into the established Insider Risk Management workflow. Analysts can review the observed activity, examine its context, determine whether it represents an actual incident, and escalate the matter through existing compliance processes.
According to Microsoft Learn, the Risky Agents policy detects activity including:
- Risky prompts submitted to an agent.
- Sensitive information appearing in agent-generated responses.
- Agent access to sensitive or priority SharePoint files.
- Connections to websites considered risky.
- Use of tools involving sensitive information.
- Sharing of SharePoint files with recipients outside the organization.
- Activity that rises above the agent’s established baseline.
A Separate Policy Track Makes Agent Risk Visible
Microsoft’s policy-management documentation now separates User policy and Agent policy views in the Purview dashboard. Agent policies cover supported agents associated with Microsoft Copilot Studio and Microsoft Foundry, while Microsoft’s monitoring guidance also identifies agents built with its P4AI SDK among the supported types.That separation should help investigators avoid forcing agent events into a user-centric model. It also gives administrators a place to inspect policy health, active alerts, confirmed alerts, and the effectiveness of actions taken against agent-related detections.
The built-in Risky Agents policy is designed to provide initial coverage without requiring every organization to construct a policy from scratch. Microsoft says it appears automatically for organizations with supported licensing and can begin generating alerts from observed agent activity.
Organizations can still build custom policies when the default detections do not match their internal governance requirements. That will be particularly relevant for enterprises where agents have specialized roles, such as processing financial records, assisting developers, interacting with customer data, or operating across regulated repositories.
A baseline anomaly may carry very different significance depending on the agent. A customer-service agent unexpectedly reading engineering files is more suspicious than a knowledge-management agent accessing the same location. Conversely, an agent designed for broad enterprise search may require tighter controls around what it can reproduce or share rather than simple alerts based on access volume.
Agent risk calculated in Insider Risk Management can also be shared with Microsoft’s Data Security Posture Management for AI and surfaced through the Microsoft 365 admin center. This points to a broader strategy in which Purview supplies the data and compliance signals while other Microsoft management surfaces provide organization-wide visibility.
Deployment Status Is Less Clear Than the Roadmap Suggests
The roadmap chronology shows preview availability beginning in December 2025, followed by general availability in June 2026. The item was last updated on July 13 and applies to the web-based Purview experience in worldwide standard multi-tenant cloud environments.Yet Microsoft’s detailed monitoring page still calls Risky Agents a preview policy. The policy template documentation uses the same preview designation, even as the broader roadmap item is categorized as generally available.
This could reflect a documentation lag, a staged transition in which the underlying agent indicators have reached general availability while a particular template remains in preview, or differences between supported agent platforms. Microsoft has not clarified that distinction in the roadmap entry.
For administrators, tenant evidence should take priority over roadmap wording. Before depending on the capability for a compliance requirement, teams should confirm that the Agent policy view is present, determine which agent types are producing signals, test whether expected activity generates alerts, and check the licensing terms applied to the tenant.
The distinction between availability and coverage is equally important. A feature can be generally available while still monitoring only a subset of an organization’s agent estate. Enterprises increasingly deploy agents from multiple vendors and frameworks, alongside custom automation that may not identify itself as an agent to Microsoft’s services.
Microsoft’s own training material warns that Purview coverage varies across agent types and that some agents behave differently from users in ways that can create policy gaps. Inventorying agents and validating telemetry will therefore be a prerequisite for meaningful risk management, not an optional cleanup task after policies are enabled.
Privacy Controls Carry Over, but Governance Gets Harder
Microsoft says Insider Risk Management remains built with privacy protections, including pseudonymized users by default, role-based access controls, and audit logs. Those safeguards are intended to limit unnecessary exposure of identities and investigation data.Agent monitoring nonetheless introduces new governance questions. An alert may involve the agent, the user who issued a prompt, the identity under which a connector operated, the developer who configured the workflow, and the owner of the accessed data. Responsibility may be distributed across several teams even when Purview presents the incident as one sequence of risky activity.
Compliance teams will need procedures for distinguishing between malicious use, unsafe agent configuration, excessive permissions, and an inaccurate detection. They will also need to decide when an alert is a user conduct issue and when it is fundamentally an engineering or access-control problem.
Purview’s risk score can prioritize an event, but it cannot replace those organizational decisions. A high-risk response generated from sensitive data might demand immediate containment, while unusual access by a newly deployed indexing agent could be expected behavior that was never documented for investigators.
The practical milestone is no longer simply switching on an agent policy. It is proving that the organization knows which agents exist, which identities and tools they use, what data they are permitted to touch, and whether Purview can see enough of that activity to raise a useful alert. Roadmap item 516032 moves Microsoft closer to that goal, but the mixed preview and general-availability labeling makes tenant-level validation the first task for administrators.
References
- Primary source: Microsoft 365 Roadmap
Published: 2026-07-13T23:07:14.8221961Z
Microsoft 365 Roadmap | Microsoft 365
The Microsoft 365 Roadmap lists updates that are currently planned for applicable subscribers. Check here for more information on the status of new features and updates.www.microsoft.com
- Official source: learn.microsoft.com
Monitoring agents with Insider Risk Management | Microsoft Learn
Learn how Microsoft Purview Insider Risk Management monitors AI agent activity, surfaces risky behaviors, and helps protect against data exposure in your organization.learn.microsoft.com - Official source: techcommunity.microsoft.com
- Official source: cdn-dynmedia-1.microsoft.com
