Microsoft Purview: Data Security Investigations – analyze files tied to endpoint DLP alerts Beta
Data as of 43 minutes ago (9 September 2026)
Status In development
Release month September 2026
Release ring General Availability, Preview
Products Microsoft Purview
Cloud instances Worldwide
Platforms Web
Description
Speed up analysis of exfiltrated content by launching Data Security Investigations (DSI) from endpoint Data Loss Prevention (DLP) alerts. In DSI, define your endpoint DLP query (for example, time range, users, and endpoints). DSI then automatically gathers the related files that triggered the alerts for review (for example, UserA downloaded a file on 3/1/2026).
Change history
Added to the roadmap 12 March 2026. Tracked here since 1 September 2026. Earliest target we recorded: September 2026 (since tracked — Microsoft may have moved it before we started watching).
Nothing has changed on this item since tracking began on 1 September 2026. Changes appear here as Microsoft updates the feed.