Microsoft Purview: Introducing IRM Alert classification Beta
Data as of 2 hours ago (26 October 2026)
Description
Insider risk management will be introducing the ability to classify alerts as True positive, Benign (operational), and False positive. This will be available on all alerts where authorized analysts with the appropriate permissions can choose from a list of predefined classification reasons. Alert classification will help tenants to better classify risk within alerts to support reporting and tuning needs. This will replace existing dismissal reasons.
Change history
Added to the roadmap 22 October 2026. Tracked here since 23 October 2026. Earliest target we recorded: January 2027 (since tracked — Microsoft may have moved it before we started watching).
Nothing has changed on this item since tracking began on 23 October 2026. Changes appear here as Microsoft updates the feed.