Microsoft Purview: Insider Risk Management- IRM alerts in XDR
IRM alerts and data will be available in Microsoft Defender XDR, allowing analysts to use KQL queries to identify risky patterns. This feature will be generally available in February 2027.
What you should do
Review the new IRM settings and enable the feature in Microsoft Defender XDR as needed. AI-suggested
Details
Original Microsoft text
With this feature, IRM alerts and other supporting data will be available in the following Microsoft Defender XDR experiences: IRM alerts will be surfaced in unified alert and Incident queue in Microsoft Defender XDR. IRM alerts, Indicators and enriched events will be available in Microsoft Defender XDR advanced hunting. Analysts can leverage KQL queries to identify potentially hidden risky patterns in data security related user activity. IRM alert, Indicators and enriched events will be exposed through Graph API. This feature can be enabled through “Share data with Microsoft Defender XDR” wit…
- Type
- M365 Roadmap
- Services
- Defender
- Tags
- In development, General Availability, GCC, GCC High, DoD, Microsoft Purview, Web
- AI analysis
- Medium priority · generated by qwen2.5:7b · possibly affects Security · verify against the original