Archived roadmap update

Microsoft Purview Compliance Portal
Changes to case creation process in Purview portal when confirming alerts from Defender XDR portal and content retention periods in cases

Saved release information from our Microsoft 365 roadmap archive.

All Microsoft 365 updates

Archived update

This feature is not in the site's RSS build snapshot. The content, release status and dates below are from our saved archive and may be out of date. Check Microsoft for current availability.

Product
Microsoft Purview Compliance Portal
Saved release status
Rolling out
Original publication

Feature overview

With this release, alerts confirmed from the Defender XDR portal (security.microsoft.com) will not result in automatic case creation in the Purview portal. To create a case, Insider Risk Management analysts or investigators must manually click on the "Confirm all alerts & create case" button in the Purview portal from the alert that was previously confirmed through Defender XDR. When a case is created for a specific user based on the generated alert, related content such as online files and emails, is made available in the Content explorer tab. Additionally, any new content that generates or adds to an alert is included in the Content explorer for review during up to the 30 days from the creation of the Case. After these 30 days, new content identified for the user based on alerts will NOT be added to the Content explorer. To access new content, the existing case must be closed and a new Case created.

Archived release information

July CY2025
Preview date: April CY2025

Source: Saved Microsoft roadmap archive Feature ID: 489228

RSS snapshot built . Refreshed on rebuild and deployment.

View on Microsoft