The Microsoft Purview Data Loss Prevention (DLP) triage agent, currently in preview, helps security teams focus on the most important data loss alerts by automatically analyzing and prioritizing them. It assesses the risk level of each alert using organizational settings and provides a transparent rationale for its categorization. Embedded within Microsoft Purview experiences, the agent significantly reduces the time required for manual triage, allowing teams to improve their response time and operational efficiency.

Agent tasks: Alert triage, data risk scoring, policy violation detection, incident prioritization, contextual analysis

Agent workflow

Input: DLP policy alerts, user activity metadata, content classification, organizational risk thresholds

Output: Prioritized DLP alert queue with risk-based categorization and rationale for recommended response actions