Learn about the state of your scanned repositories and create custom reports with the information protection scanner. Labeling, classification and protection actions on scanned files are stored in SQL tables that form a foundation to feed into custom reports. GA date: January CY2027 Preview date: December CY2026
Type
M365 Roadmap
Tags
In development, General Availability, Preview, Worldwide (Standard Multi-Tenant), GCC, GCC High, Microsoft Purview, Desktop
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
IDC has named Microsoft a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises. The post IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor Assessment appeared first on Microsoft Security Blog.
Type
Announcements
Tags
Microsoft Security Blog
AI analysis
Low priority · generated by qwen2.5:7b · possibly affects Security · verify against the original
As Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed and efficiency of attacks, we’ve identified North Korean threat actors expanding their use of AI with varying levels of adoption. This blog breaks down how North Korean threat actors are utilizing AI across their operations, reflecting a broader trend of threat actors incorporating AI into their attack chains. The post Tracking AI adoption in North Korean threat actor tradecraft appeared first on Microsoft Security Blog.
Type
Announcements
Tags
Microsoft Security Blog, Sapphire Sleet, Sleet, Social engineering
AI analysis
Low priority · generated by qwen2.5:7b · possibly affects Security · verify against the original
Microsoft Purview compliance portal is enhancing policy conditions to detect external email communications and allow combining multiple conditions with an OR capability. Testing conditions before implementation is also introduced.
Three updates are coming to enhance policy conditions. First, our updated policy conditions enable the detection of messages sent and received both to and from external email addresses, allowing you to identify specific instances of information being shared with external contacts. Secondly, with the new OR condition capability, you can combine multiple conditions within the same policy, creating custom logic to suit your unique compliance requirements. Lastly, to make policy creation and updates a seamless process, we've introduced the ability to test conditions before implementing them. By us…
Type
M365 Roadmap
Tags
In development, General Availability, GCC, GCC High, DoD, Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
As AI and agents reshape the enterprise, CISOs face two critical priorities: enabling innovation with the right identity and data guardrails, and modernizing defense to keep pace with AI-powered threats. Aarti Borkar shares how security leaders can approach both. The post The CISO’s evolving role: Protecting and defending in the agentic era appeared first on Microsoft Security Blog.
Type
Announcements
Tags
Microsoft Security Blog
AI analysis
Low priority · generated by qwen2.5:7b · possibly affects Security · verify against the original
The Unified Classification Management Experience unifies every classifier in Microsoft Purview—Sensitive Information Types (SITs), Exact Data Match (EDM), fingerprint SITs, and trainable classifiers—into one place to discover, create, validate, and manage classifiers. GA date: January CY2027 Preview date: October CY2026
Type
M365 Roadmap
Tags
In development, General Availability, Preview, Worldwide (Standard Multi-Tenant), Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · possibly affects Security · verify against the original
Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations. The post Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks appeared first on Microsoft Security Blog.
Type
Announcements
Tags
Microsoft Security Blog, Supply chain attack
AI analysis
Medium priority · generated by qwen2.5:7b · verify against the original
The security agent is now available within the Power Pages design studio, allowing makers to configure authentication and authorization settings using natural language commands. This feature is enabled for admins/makers/marketers automatically.
The security agent is available directly within the security workspace in Power Pages design studio. Makers can open the security agent tab to access the embedded chat panel and security tools. From there, they can interact using natural language to review risks, understand configurations, and take guided actions. The agent assists with both authentication and authorization setup. It guides makers through configuring identity providers, reviewing authentication settings, and strengthening login protections. Based on the site’s setup, it can recommend improvements such as securing token configu…
Type
M365 Roadmap
Tags
In development, General Availability, Preview, Worldwide (Standard Multi-Tenant), Power Pages, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
Microsoft Purview Adaptive Protection will automatically apply retention labels to preserve deleted emails and files based on a user’s insider risk level, starting with a preview in June 2024.
Adaptive Protection in Microsoft Purview helps you protect your organization’s data by integrating dynamic insider risk levels, determined by data related activities, with various policy engines to automatically moving users in and out of policies as their risk levels change over time. The integration with Data Lifecycle Management will automatically apply retention labels to preserve deleted emails and files based on a user’s insider risk level. GA date: December CY2026 Preview date: June CY2024
Type
M365 Roadmap
Tags
In development, General Availability, Preview, Worldwide (Standard Multi-Tenant), Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
Microsoft Purview compliance portal is enhancing alerting and customization features for Communication Compliance. These improvements will be generally available in January 2027 and previewed in July 2025.
This feature is about improving the alerting capabilities and customization in Communication Compliance. GA date: January CY2027 Preview date: July CY2025
Type
M365 Roadmap
Tags
In development, General Availability, Preview, Worldwide (Standard Multi-Tenant), Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
Adaptive Protection in Microsoft Purview will integrate with Data Lifecycle Management to automatically apply retention labels based on user risk levels, effective February CY2027.
Adaptive Protection in Microsoft Purview helps you protect your organization’s data by integrating dynamic insider risk levels, determined by data related activities, with various policy engines to automatically moving users in and out of policies as their risk levels change over time. The integration with Data Lifecycle Management will automatically apply retention labels to preserve deleted emails and files based on a user’s insider risk level. GA date: February CY2027
Type
M365 Roadmap
Tags
In development, General Availability, GCC, GCC High, DoD, Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
Admins can now view a per-policy coverage report for auto-labeling policies, showing labeled and unlabeled files and their correlation with the latest simulation run.
For each enforced auto-labeling policy, admins can view how files processed during enforcement correlate to the latest simulation run. The per-policy coverage report shows volumes of files that have been labeled or are not yet labeled, and whether those files were included in the last simulation snapshot. This helps admins understand enforcement progress for a specific policy against the data state captured during simulation, while also identifying files that were not found in the simulation snapshot but were processed during enforcement. GA date: October CY2026 Preview date: September CY2026
Type
M365 Roadmap
Tags
Rolling out, General Availability, Preview, Worldwide (Standard Multi-Tenant), Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
Microsoft Purview will support access to Archive mailboxes via the Microsoft Graph API, providing a unified view even when data is spread across multiple auxiliary mailboxes. EWS Graph APIs for Archive mailboxes will be deprecated.
Access to Archive mailboxes (Main + Auxiliary) through Microsoft Graph. The goal is to give users a single, seamless Archive view, even though Archive data may physically reside across multiple auxiliary mailboxes with EWS Graph APIs being deprecated. GA date: December CY2026
Type
M365 Roadmap
Tags
In development, General Availability, GCC, GCC High, DoD, Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
Microsoft Purview Insider Risk Management will introduce the ability to classify alerts as True positive, Benign (operational), and False positive, replacing existing dismissal reasons. This feature will be generally available in January 2027 with a preview in November 2026.
Insider risk management will be introducing the ability to classify alerts as True positive, Benign (operational), and False positive. This will be available on all alerts where authorized analysts with the appropriate permissions can choose from a list of predefined classification reasons. Alert classification will help tenants to better classify risk within alerts to support reporting and tuning needs. This will replace existing dismissal reasons. GA date: January CY2027 Preview date: November CY2026
Type
M365 Roadmap
Tags
In development, General Availability, Preview, Worldwide (Standard Multi-Tenant), GCC, GCC High, DoD, Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
Out-of-box MTTA/MTTD/MTTR SLA Alert Reporting dashboard showing past trends, Top SITs getting exposed via DLP alerts generated. Customers can define their custom SLAs for high, med and low severity alerts and get access to dashboard showing operational performance and SLA metrics. GA date: January CY2027 Preview date: December CY2026
Type
M365 Roadmap
Tags
In development, General Availability, Preview, Worldwide (Standard Multi-Tenant), Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments. The post AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise appeared first on Microsoft Security Blog.
Type
Announcements
Tags
Microsoft Security Blog, Supply chain attack
AI analysis
High priority · generated by qwen2.5:7b · verify against the original
The auto-expanding archive limit for Microsoft Purview has increased beyond 1.5 TB, allowing for scalable archive growth for customers with eligible E5 licenses.
Previously, auto expanding archive mailbox expansion was supported only up to 1.5 TB, after which mailboxes would become inoperative. Archive mailboxes can now automatically expand beyond the 1.5 TB limit, ensuring uninterrupted retention and enabling scalable archive growth as storage thresholds are reached. This capability to expand archive beyond 1.5 TB will be available to customers with eligible E5 licenses. GA date: October CY2026
Type
M365 Roadmap
Tags
Rolling out, General Availability, Worldwide (Standard Multi-Tenant), Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
Microsoft Purview Data Loss Prevention introduces a new View-Only Device Management role to provide read-only access to device onboarding, allowing auditors or security analysts to view device onboarding status without administrative permissions.
Microsoft Purview Data Loss Prevention is introducing more granular, role-based access to the Devices page under Settings → Device Onboarding. Previously, viewing or managing device onboarding required broad administrative roles (such as Compliance Administrator, Global Administrator, or Security Administrator). With this update, organizations can grant access using least-privilege Purview role-based access control (RBAC) roles scoped specifically to device operations. A new View-Only Device Management role enables users, such as auditors or security analysts, to view device onboarding status,…
Type
M365 Roadmap
Tags
In development, General Availability, Preview, Worldwide (Standard Multi-Tenant), Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
Microsoft Purview Compliance Manager will integrate with Microsoft Foundry to automatically map AI regulations and evaluate compliance controls for Foundry Agents. This feature is expected to be generally available in January 2027, with a preview in December 2025.
This feature in Purview Compliance Manager shall enable customers to automatically access the compliance posture of Agents created in AI Foundry. Customers can map Agents being created in AI Foundry to compliance regulations and assessments in Purview Compliance Manager and get to know the compliance status and improvement actions to be innovative and compliant. GA date: January CY2027 Preview date: December CY2025
Type
M365 Roadmap
Tags
In development, General Availability, Preview, Worldwide (Standard Multi-Tenant), Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
Microsoft Purview DLP is expanding to Microsoft Cowork, allowing data security admins to apply a single policy across Microsoft 365 Copilot and Cowork to protect sensitive AI interactions.
Microsoft Purview Data Loss Prevention (DLP) is expanding to Microsoft Cowork, enabling data security admins to use a single policy across Microsoft 365 Copilot and Cowork. The integration helps protect sensitive AI interactions by preventing the use of labeled knowledge sources, blocking prompts that contain supported sensitive information types, and restricting sensitive prompts from being sent to Bing for web search. GA date: October CY2026 Preview date: September CY2026
Type
M365 Roadmap
Tags
Rolling out, General Availability, Preview, Worldwide (Standard Multi-Tenant), Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
Microsoft 365 E7 and Project Perception introduce new capabilities to help organizations manage and adapt security measures to match the speed of agents.
New capabilities in Microsoft 365 E7 and Project Perception help organizations contain agent risk and adapt protection continuously. The post Agents are your newest insiders. Security must move at their speed. appeared first on Microsoft Security Blog.
Type
Announcements
Tags
Microsoft Security Blog
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
IRM alerts and data will be available in Microsoft Defender XDR, allowing analysts to use KQL queries to identify risky patterns. This feature will be enabled through Microsoft Insider Risk Management settings and is generally available in February 2027.
With this feature, IRM alerts and other supporting data will be available in the following Microsoft Defender XDR experiences: IRM alerts will be surfaced in unified alert and Incident queue in Microsoft Defender XDR. IRM alerts, Indicators and enriched events will be available in Microsoft Defender XDR advanced hunting. Analysts can leverage KQL queries to identify potentially hidden risky patterns in data security related user activity. IRM alert, Indicators and enriched events will be exposed through Graph API. This feature can be enabled through “Share data with Microsoft Defender XDR” wit…
Type
M365 Roadmap
Services
Defender
Tags
In development, General Availability, GCC, GCC High, DoD, Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · possibly affects Security · verify against the original
New whitepaper from Microsoft and NVIDIA helps enterprises manage open-weight AI model risks with a shared taxonomy, evaluations, and controls. The post Managing open-weight model risk in enterprise deployments appeared first on Microsoft Security Blog.
Type
Announcements
Tags
Microsoft Security Blog
AI analysis
Low priority · generated by qwen2.5:7b · possibly affects Security · verify against the original
Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators (tracked as Storm-2990), and an illicit marketplace (tracked as Storm-3119) selling tools and infrastructure for large-scale phishing. In collaboration with law enforcement agencies and other partners worldwide, Microsoft’s Digital Crimes Unit (DCU) facilitated a disruption of the ecosystem. The post The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime appeared first on Microsoft Security Blog.
Type
Announcements
Tags
Microsoft Security Blog, Phishing, Social engineering
AI analysis
Low priority · generated by qwen2.5:7b · possibly affects Security · verify against the original
Prepare for post-quantum authentication by testing certificate ecosystems now. Learn how Microsoft’s PQC TLS Pilot Program helps advance future readiness. The post Post-quantum authentication: Why organizations should start testing certificate ecosystems now appeared first on Microsoft Security Blog.
Type
Announcements
Tags
Microsoft Security Blog, Quantum
AI analysis
Medium priority · generated by qwen2.5:7b · possibly affects Security · verify against the original