Microsoft Purview Insider Risk Management (IRM) will let analysts classify alerts as True positive, Benign (operational) or False positive. The feature is on the Microsoft 365 Roadmap as item 576710, status In development, with preview in November 2026 and rollout starting in January 2027.
What changes
- Classification is available on all IRM alerts.
- Authorized analysts with the appropriate permissions pick from a list of predefined classification reasons.
- Classification replaces the existing dismissal reasons.
- The stated purpose is better risk classification within alerts, to support reporting and tuning.
Timeline and scope
| Item | Value |
|---|---|
| Roadmap ID | 576710 |
| Status | In development |
| Preview | November 2026 |
| Rollout start (GA) | January 2027 |
| Clouds | Worldwide (Standard Multi-Tenant), GCC, GCC High, DoD |
| Platform | Web |
The roadmap entry was added 2026-10-22. Dates can change; Microsoft states roadmap information is subject to change.
Why it matters
Today the IRM Standard alert dashboard offers Dismissed with reasons such as “Activity is expected for this user” and “Alerts for this user contain too much activity”. Those reasons describe why an alert was closed, not whether the detection was right. A true/benign/false split gives a signal that can feed tuning of policies and indicator thresholds, and it lines up more closely with how Microsoft Defender XDR classifies alerts.
For reference, the current Defender-to-IRM classification sync maps True positive to Confirmed and both benign positive and false positive to Dismissed. Whether and how that mapping changes once IRM has its own classifications is not stated in the roadmap entry.
What to do
- Check who holds the IRM analyst and investigator roles, since classification is permission-gated.
- If you report on dismissal reasons (exports, SIEM/SOAR via the Office 365 Management Activity API, dashboards), plan for the reason values to change.
- Update triage runbooks to describe when to use each classification.
- Watch the roadmap item for date changes before preview.
Caveats
- The roadmap entry gives no list of the predefined reasons and no documentation link. No Microsoft Learn page describes the feature yet, so details such as bulk classification, audit-log events and export schema changes are unconfirmed.
- Current Learn documentation still describes dismissal reasons and the existing Defender classification mapping.