New Agents in Microsoft Purview
Security teams often face alert overload and hidden data risks. This video shows how Microsoft Purview agents, powered by Security Copilot, help you focus on what matters most. Watch how the Data Security Triage Agent prioritizes incidents and how the Data Security Posture Agent surfaces risks through natural language queries.
What are the new agents in Microsoft Purview?
The new agents in Microsoft Purview are designed to streamline daily data security work and help security teams focus on real risks instead of noise. They are powered by Security Copilot and currently include:
- Data Security Triage Agent – helps you manage and prioritize Insider Risk and DLP alerts.
- Data Security Posture Agent – helps you uncover hidden data risks and improve your overall data security posture.
Together, these agents help you:
- Cut through alert overload and reduce time spent on false positives.
- Quickly understand which incidents need attention and why.
- Use natural-language queries to explore data risk and posture.
- Apply labels and trigger security policies directly from insights to proactively prevent data loss.
The result is a faster, more efficient way to manage data security inside Microsoft Purview, while staying ahead of emerging threats.
How does the Data Security Triage Agent reduce alert overload?
The Data Security Triage Agent is built to help teams rethink how they handle Insider Risk and DLP alerts. Instead of manually sifting through every notification, you can use the agent to:
- Cut through alert overload by automatically highlighting the incidents that are most likely to be real risks.
- Eliminate false positives more quickly, so analysts spend less time on low-value investigations.
- See clear, contextual reasoning behind each alert, so you understand why it was raised and what to look at next.
- Stay in control with automated user outreach, helping you follow up with users directly from the workflow.
By reshaping the triage process, the agent helps security teams act faster on meaningful alerts and reduce time spent on routine or low-risk events.
What does the Data Security Posture Agent actually do?
The Data Security Posture Agent helps you reimagine how you discover and address data risks that are not obvious at first glance. Its core capabilities include:
- Natural-language queries – you can ask questions about your data security posture in everyday language to uncover risks that may be hidden behind complex context.
- Risk discovery – when the agent finds issues, it surfaces them as actionable insights rather than raw signals.
- Direct remediation – from those insights, you can apply sensitivity labels and trigger security policies immediately, without jumping between tools.
This approach helps you move from reactive investigation to proactive prevention of data loss, using the same Microsoft Purview environment you already rely on for data security and compliance.
New Agents in Microsoft Purview
published by CX Consulting (Pty) Ltd
CX Consulting was established in 2020 by Pieter vd Walt. With the ever increasing threat of cyber attacks and cyber crime, organisations are often at a loss at what to do. New software vulnerabilities are found daily, web application attacks leave websites vulnerable and viruses become increasingly silent and stealthy. Often, the simplest things such as weak passwords and uneducated staff can be the cause of an entire company infrastructure being compromised. Our aim is to make your company or organisation as unattractive to cybercriminals as possible - and keeping your sensitive financial and client data safe. This is done in a variety of ways including attack and penetration testing, vulnerability assessments, user awareness campaigns, and keeping your company constantly safe with a month-to-month service level agreement. We also consult and provide managed IT services to support medium sized firms with their IT infrastructure. We are a premium IT service provider focused on medium sized businesses. We no longer focus on the break & fix model as our aim is to prevent and minimize downtime.
Sign in with LinkedIn