Microsoft Purview compliance portal is enhancing policy conditions to detect external communications and allow combining multiple conditions with an OR capability. Testing conditions before implementation is also introduced.
What you should do
Review the new policy conditions and test them with sample messages to ensure they meet your compliance requirements. AI-suggested
Three updates are coming to enhance policy conditions. First, our updated policy conditions enable the detection of messages sent and received both to and from external email addresses, allowing you to identify specific instances of information being shared with external contacts. Secondly, with the new OR condition capability, you can combine multiple conditions within the same policy, creating custom logic to suit your unique compliance requirements. Lastly, to make policy creation and updates a seamless process, we've introduced the ability to test conditions before implementing them. By us…
Type
M365 Roadmap
Tags
In development, General Availability, GCC, GCC High, DoD, Microsoft Purview, Web
AI analysis
Medium priority · generated by qwen2.5:7b · verify against the original
The security agent is now available directly in Power Pages design studio, allowing makers to configure authentication and authorization with guided assistance.
What you should do
Review the new security agent feature in Power Pages design studio to understand how it can assist with secure access control setup. AI-suggested
The security agent is available directly within the security workspace in Power Pages design studio. Makers can open the security agent tab to access the embedded chat panel and security tools. From there, they can interact using natural language to review risks, understand configurations, and take guided actions. The agent assists with both authentication and authorization setup. It guides makers through configuring identity providers, reviewing authentication settings, and strengthening login protections. Based on the site’s setup, it can recommend improvements such as securing token configu…
Type
M365 Roadmap
Tags
In development, General Availability, Preview, Worldwide (Standard Multi-Tenant), Power Pages, Web
AI analysis
Medium priority · generated by qwen2.5:7b · verify against the original
Microsoft Purview Adaptive Protection will automatically apply retention labels to preserve deleted emails and files based on a user’s insider risk level.
What you should do
Review the new data preservation policies to ensure they align with your organization's compliance requirements. AI-suggested
Adaptive Protection in Microsoft Purview helps you protect your organization’s data by integrating dynamic insider risk levels, determined by data related activities, with various policy engines to automatically moving users in and out of policies as their risk levels change over time. The integration with Data Lifecycle Management will automatically apply retention labels to preserve deleted emails and files based on a user’s insider risk level. GA date: December CY2026 Preview date: June CY2024
Type
M365 Roadmap
Tags
In development, General Availability, Preview, Worldwide (Standard Multi-Tenant), Microsoft Purview, Web
AI analysis
Medium priority · generated by qwen2.5:7b · verify against the original
Microsoft Purview Adaptive Protection will integrate with Data Lifecycle Management to automatically apply retention labels based on user risk levels, effective February 2027.
What you should do
Review the new integration to ensure policies are correctly configured for data protection. AI-suggested
Adaptive Protection in Microsoft Purview helps you protect your organization’s data by integrating dynamic insider risk levels, determined by data related activities, with various policy engines to automatically moving users in and out of policies as their risk levels change over time. The integration with Data Lifecycle Management will automatically apply retention labels to preserve deleted emails and files based on a user’s insider risk level. GA date: February CY2027
Type
M365 Roadmap
Tags
In development, General Availability, GCC, GCC High, DoD, Microsoft Purview, Web
AI analysis
Medium priority · generated by qwen2.5:7b · verify against the original
Admins can now view a per-policy coverage report for auto-labeling policies, showing labeled and unlabeled files and their correlation with the latest simulation run.
What you should do
Review the new reporting feature to understand enforcement progress and identify any files that were not included in the simulation. AI-suggested
For each enforced auto-labeling policy, admins can view how files processed during enforcement correlate to the latest simulation run. The per-policy coverage report shows volumes of files that have been labeled or are not yet labeled, and whether those files were included in the last simulation snapshot. This helps admins understand enforcement progress for a specific policy against the data state captured during simulation, while also identifying files that were not found in the simulation snapshot but were processed during enforcement. GA date: October CY2026 Preview date: September CY2026
Type
M365 Roadmap
Tags
Rolling out, General Availability, Preview, Worldwide (Standard Multi-Tenant), Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
Microsoft Purview now supports access to Archive mailboxes via the Microsoft Graph API, providing a unified view of archive data across main and auxiliary mailboxes.
What you should do
Review the updated data management processes to ensure compliance with the new archive mailbox access method. AI-suggested
Access to Archive mailboxes (Main + Auxiliary) through Microsoft Graph. The goal is to give users a single, seamless Archive view, even though Archive data may physically reside across multiple auxiliary mailboxes with EWS Graph APIs being deprecated. GA date: December CY2026
Type
M365 Roadmap
Tags
In development, General Availability, GCC, GCC High, DoD, Microsoft Purview, Web
AI analysis
Medium priority · generated by qwen2.5:7b · verify against the original
Microsoft Purview Insider Risk Management will introduce alert classification options: True positive, Benign (operational), and False positive. This replaces existing dismissal reasons and will be generally available in January 2027.
What you should do
Review the new alert classification options to ensure they meet your reporting and tuning needs. AI-suggested
Insider risk management will be introducing the ability to classify alerts as True positive, Benign (operational), and False positive. This will be available on all alerts where authorized analysts with the appropriate permissions can choose from a list of predefined classification reasons. Alert classification will help tenants to better classify risk within alerts to support reporting and tuning needs. This will replace existing dismissal reasons. GA date: January CY2027 Preview date: November CY2026
Type
M365 Roadmap
Tags
In development, General Availability, Preview, Worldwide (Standard Multi-Tenant), GCC, GCC High, DoD, Microsoft Purview, Web
AI analysis
Medium priority · generated by qwen2.5:7b · verify against the original
Previously, auto expanding archive mailbox expansion was supported only up to 1.5 TB, after which mailboxes would become inoperative. Archive mailboxes can now automatically expand beyond the 1.5 TB limit, ensuring uninterrupted retention and enabling scalable archive growth as storage thresholds are reached. This capability to expand archive beyond 1.5 TB will be available to customers with eligible E5 licenses. GA date: October CY2026
Type
M365 Roadmap
Tags
Rolling out, General Availability, Worldwide (Standard Multi-Tenant), Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
Microsoft Purview Data Loss Prevention introduces a new View-Only Device Management role to provide read-only access to device onboarding for auditors and security analysts.
What you should do
Review the new role-based access control options to ensure least-privilege access for auditors and security analysts. AI-suggested
Microsoft Purview Data Loss Prevention is introducing more granular, role-based access to the Devices page under Settings → Device Onboarding. Previously, viewing or managing device onboarding required broad administrative roles (such as Compliance Administrator, Global Administrator, or Security Administrator). With this update, organizations can grant access using least-privilege Purview role-based access control (RBAC) roles scoped specifically to device operations. A new View-Only Device Management role enables users, such as auditors or security analysts, to view device onboarding status,…
Type
M365 Roadmap
Tags
In development, General Availability, Preview, Worldwide (Standard Multi-Tenant), Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
Microsoft Purview Data Loss Prevention (DLP) is expanding to Microsoft Cowork, enabling data security admins to use a single policy across Microsoft 365 Copilot and Cowork. The integration helps protect sensitive AI interactions by preventing the use of labeled knowledge sources, blocking prompts that contain supported sensitive information types, and restricting sensitive prompts from being sent to Bing for web search. GA date: October CY2026 Preview date: September CY2026
Type
M365 Roadmap
Tags
Rolling out, General Availability, Preview, Worldwide (Standard Multi-Tenant), Microsoft Purview, Web
AI analysis
Medium priority · generated by qwen2.5:7b · verify against the original
New capabilities in Microsoft 365 E7 and Project Perception help organizations contain agent risk and adapt protection continuously. The post Agents are your newest insiders. Security must move at their speed. appeared first on Microsoft Security Blog.
Type
Announcements
Tags
Microsoft Security Blog
AI analysis
Medium priority · generated by qwen2.5:7b · verify against the original
IRM alerts and data will be available in Microsoft Defender XDR, allowing analysts to use KQL queries to identify risky patterns. This feature will be generally available in February 2027.
What you should do
Review the new IRM settings and enable the feature in Microsoft Defender XDR as needed. AI-suggested
With this feature, IRM alerts and other supporting data will be available in the following Microsoft Defender XDR experiences: IRM alerts will be surfaced in unified alert and Incident queue in Microsoft Defender XDR. IRM alerts, Indicators and enriched events will be available in Microsoft Defender XDR advanced hunting. Analysts can leverage KQL queries to identify potentially hidden risky patterns in data security related user activity. IRM alert, Indicators and enriched events will be exposed through Graph API. This feature can be enabled through “Share data with Microsoft Defender XDR” wit…
Type
M365 Roadmap
Services
Defender
Tags
In development, General Availability, GCC, GCC High, DoD, Microsoft Purview, Web
AI analysis
Medium priority · generated by qwen2.5:7b · possibly affects Security · verify against the original
Prepare for post-quantum authentication by testing certificate ecosystems now. Learn how Microsoft’s PQC TLS Pilot Program helps advance future readiness. The post Post-quantum authentication: Why organizations should start testing certificate ecosystems now appeared first on Microsoft Security Blog.
Type
Announcements
Tags
Microsoft Security Blog, Quantum
AI analysis
Medium priority · generated by qwen2.5:7b · possibly affects Security · verify against the original
A critical security vulnerability in Microsoft SQL Server allows unauthorized attackers to execute code over a network. This affects all instances of SQL Server.
What you should do
Apply the security update immediately to mitigate the vulnerability. AI-suggested
A critical security vulnerability in Microsoft SQL Server allows unauthorized attackers to execute code over a network due to untrusted pointer dereference.
What you should do
Apply the security update as soon as possible to mitigate the risk of remote code execution. AI-suggested
A critical security vulnerability in Microsoft SQL Server allows unauthorized attackers to elevate privileges over a network. This affects all users of SQL Server.
What you should do
Apply the latest SQL Server security patches immediately to mitigate this vulnerability. AI-suggested
Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.
Severity
Critical · CVSS 9.6
Type
Security updates
Tags
SQL Server, Elevation of Privilege, 2026-Sep
AI analysis
Critical priority · generated by qwen2.5:7b · verify against the original