New Agents in Microsoft Purview
Security teams often face alert overload and hidden data risks. This video shows how Microsoft Purview agents, powered by Security Copilot, help you focus on what matters most. Watch how the Data Security Triage Agent prioritizes incidents and how the Data Security Posture Agent surfaces risks through natural language queries.
What are the new agents in Microsoft Purview?
The new agents in Microsoft Purview are designed to streamline daily data security work and help teams focus on real risks instead of noise. They are powered by Security Copilot and integrate directly into your existing Purview environment.
There are two key agents:
- Data Security Triage Agent – Helps you manage and prioritize Insider Risk and DLP alerts so you can quickly see which incidents actually need attention.
- Data Security Posture Agent – Helps you uncover hidden data risks using natural-language queries and then act on those insights.
Together, these agents help you rethink how you manage data security by reducing manual review, clarifying risk context, and making it easier to move from insight to action.
How does the Data Security Triage Agent reduce alert overload?
The Data Security Triage Agent is built to help you cut through the volume of alerts that typically come from Insider Risk and DLP solutions.
It supports your team in three main ways:
- Reducing alert overload: It helps you quickly filter and organize alerts so you can see which incidents are most likely to matter, instead of reviewing everything manually.
- Eliminating false positives: By providing clearer context around each alert, the agent makes it easier to dismiss low-risk or irrelevant incidents.
- Explaining the “why” behind alerts: Each alert comes with clear, contextual reasoning, so analysts can understand what triggered it and decide on next steps faster.
On top of that, the agent supports automated user outreach, helping you stay in control of follow-up actions without adding more manual work for your team.
What does the Data Security Posture Agent actually do?
The Data Security Posture Agent in Microsoft Purview is focused on helping you reimagine how you identify and address data risks across your environment.
Key capabilities include:
- Natural-language risk discovery: You can use natural-language queries to uncover risks that might be hidden behind complex context, instead of relying only on predefined reports.
- Direct action from insights: When the agent finds an issue, you can apply sensitivity labels and trigger security policies directly from the insight, without switching tools.
- Proactive data loss prevention: By moving from reactive alert handling to proactive posture management, you can address risky configurations and behaviors before they lead to data loss.
Because it is powered by Security Copilot, the Posture Agent gives you a faster and more efficient way to move from “What’s going on?” to “Here’s what we’re doing about it.”
New Agents in Microsoft Purview
published by CX Consulting (Pty) Ltd
CX Consulting was established in 2020 by Pieter vd Walt. With the ever increasing threat of cyber attacks and cyber crime, organisations are often at a loss at what to do. New software vulnerabilities are found daily, web application attacks leave websites vulnerable and viruses become increasingly silent and stealthy. Often, the simplest things such as weak passwords and uneducated staff can be the cause of an entire company infrastructure being compromised. Our aim is to make your company or organisation as unattractive to cybercriminals as possible - and keeping your sensitive financial and client data safe. This is done in a variety of ways including attack and penetration testing, vulnerability assessments, user awareness campaigns, and keeping your company constantly safe with a month-to-month service level agreement. We also consult and provide managed IT services to support medium sized firms with their IT infrastructure. We are a premium IT service provider focused on medium sized businesses. We no longer focus on the break & fix model as our aim is to prevent and minimize downtime.
Sign in with LinkedIn