Microsoft Purview Compliance Portal: Changes to case creation process in Purview portal when confirming alerts from Defender XDR portal and content retention periods in cases

With this release, alerts confirmed from the Defender XDR portal (security.microsoft.com) will not result in automatic case creation in the Purview portal. To create a case, Insider Risk Management analysts or investigators must manually click on the "Confirm all alerts & create case" button in the Purview portal from the alert that was previously confirmed through Defender XDR. When a case is created for a specific user based on the generated alert, related content such as online files and emails, is made available in the Content explorer tab. Additionally, any new content that generates or adds to an alert is included in the Content explorer for review during up to the 30 days from the creation of the Case. After these 30 days, new content identified for the user based on alerts will NOT be added to the Content explorer. To access new content, the existing case must be closed and a new Case created.

July CY2025
Preview date: April CY2025