In development
Microsoft Purview: Introducing IRM Alert classification
From Microsoft's description: “This will replace existing dismissal reasons.</p>”
<p>Insider risk management will be introducing the ability to classify alerts as True positive, Benign (operational), and False positive. This will be available on all alerts where authorized analysts with the appropriate permissions can choose from a list of predefined classification reasons. Alert classification will help tenants to better classify risk within alerts to support reporting and tuning needs. This will replace existing dismissal reasons.</p>
Affected: Microsoft Purview
Related changes
Change history
2026-10-23 · First captured by tracker