Microsoft Purview: Introducing IRM Alert classification
Microsoft Purview Insider Risk Management (IRM) will let analysts classify alerts as True positive, Benign (operational) or False positive. The feature is on the Microsoft 365 Roadmap as item 576710, status In development, with preview in November 2026 and rollout starting in January 2027. What changes Classification is available on all IRM alerts. Authorized analysts with the appropriate permissions pick from a list of predefined classification reasons. Classification replaces the existing dismissal reasons. The stated purpose is better risk classification within alerts, to support reporting and tuning. Timeline and scope Item Value Roadmap ID 576710 Status In development Preview November 2026 Rollout start (GA) January 2027 Clouds Worldwide (Standard Multi-Tenant), GCC, GCC High, DoD Platform Web The roadmap entry was added 2026-10-22. Dates can change; Microsoft states roadmap information is subject to change. ...