The new agents in Microsoft Purview are designed to streamline daily data security work and help teams focus on real risks instead of noise. They are powered by Security Copilot and integrate directly into your existing Purview environment.

There are two key agents:

• Data Security Triage Agent – Helps you manage and prioritize Insider Risk and DLP alerts so you can quickly see which incidents actually need attention.
• Data Security Posture Agent – Helps you uncover hidden data risks using natural-language queries and then act on those insights.

Together, these agents help you rethink how you manage data security by reducing manual review, clarifying risk context, and making it easier to move from insight to action.

The Data Security Triage Agent is built to help you cut through the volume of alerts that typically come from Insider Risk and DLP solutions.

It supports your team in three main ways:

• Reducing alert overload: It helps you quickly filter and organize alerts so you can see which incidents are most likely to matter, instead of reviewing everything manually.
• Eliminating false positives: By providing clearer context around each alert, the agent makes it easier to dismiss low-risk or irrelevant incidents.
• Explaining the “why” behind alerts: Each alert comes with clear, contextual reasoning, so analysts can understand what triggered it and decide on next steps faster.

On top of that, the agent supports automated user outreach, helping you stay in control of follow-up actions without adding more manual work for your team.

The Data Security Posture Agent in Microsoft Purview is focused on helping you reimagine how you identify and address data risks across your environment.

Key capabilities include:

• Natural-language risk discovery: You can use natural-language queries to uncover risks that might be hidden behind complex context, instead of relying only on predefined reports.
• Direct action from insights: When the agent finds an issue, you can apply sensitivity labels and trigger security policies directly from the insight, without switching tools.
• Proactive data loss prevention: By moving from reactive alert handling to proactive posture management, you can address risky configurations and behaviors before they lead to data loss.

Because it is powered by Security Copilot, the Posture Agent gives you a faster and more efficient way to move from “What’s going on?” to “Here’s what we’re doing about it.”