Microsoft Purview Data Security Investigations: Notifications and enhanced search

Microsoft Purview Data Security Investigations will add notifications for key events and improved query building, reducing manual monitoring and speeding investigations. These AI-enhanced features roll out worldwide from early to late June 2026, require no admin action, and improve compliance visibility and investigation efficiency.

[Introduction]

We are introducing notification capabilities and improved search in Microsoft Purview Data Security Investigations. These updates reduce the need for manual status checks and simplify how investigators identify potentially impacted data.

This message is associated with Microsoft 365 Roadmap ID 560325.

[When this will happen]

General Availability (Worldwide): Rolling out in early June 2026 and expected to complete by late June 2026.

[How this affects your organization]

Who is affected

• Investigators and analysts using Microsoft Purview Data Security Investigations

What will happen

• Investigators will receive notifications for key investigation events, including AI job completion and new data added to scope.
• Users will no longer need to manually monitor long-running jobs or data ingestion.
• Improved query building simplifies how investigators construct searches without needing to create complex queries from scratch.
• These improvements reduce time required to scope new investigations.
• The feature is enabled by default.

[What you can do to prepare]

• No admin action is required.
• Inform your investigation teams that notifications will begin appearing in Data Security Investigations.
• Update internal investigation or triage workflows to incorporate real-time notifications.
• Review current search and query practices to take advantage of the improved experience.

Learn more: 

• Data Security Investigations | Microsoft Purview portal
• Learn about Data Security Investigations | Microsoft Purview | Microsoft Learn

[Compliance considerations]

Question	Answer
Does the change alter how existing customer data is processed, stored, or accessed?	Yes. AI-powered investigation workflows and improved query capabilities may change how investigators access and analyze scoped data, but do not change the underlying data storage.
Does the change introduce or significantly modify AI/ML or agent capabilities that interact with customer data?	Yes. The feature includes AI job processing with added notification triggers when jobs complete, enhancing visibility into AI-driven analysis steps.
Does the change alter how admins can monitor, report on, or demonstrate compliance activities?	Yes. Notifications improve visibility into investigation progress, which can support faster response and reporting workflows for compliance teams.