The new agents in Microsoft Purview are designed to streamline daily data security work and help security teams focus on real risks instead of noise. They are powered by Security Copilot and currently include:

• Data Security Triage Agent – helps you manage and prioritize Insider Risk and DLP alerts.
• Data Security Posture Agent – helps you uncover hidden data risks and improve your overall data security posture.

Together, these agents help you:

• Cut through alert overload and reduce time spent on false positives.
• Quickly understand which incidents need attention and why.
• Use natural-language queries to explore data risk and posture.
• Apply labels and trigger security policies directly from insights to proactively prevent data loss.

The result is a faster, more efficient way to manage data security inside Microsoft Purview, while staying ahead of emerging threats.

The Data Security Triage Agent is built to help teams rethink how they handle Insider Risk and DLP alerts. Instead of manually sifting through every notification, you can use the agent to:

• Cut through alert overload by automatically highlighting the incidents that are most likely to be real risks.
• Eliminate false positives more quickly, so analysts spend less time on low-value investigations.
• See clear, contextual reasoning behind each alert, so you understand why it was raised and what to look at next.
• Stay in control with automated user outreach, helping you follow up with users directly from the workflow.

By reshaping the triage process, the agent helps security teams act faster on meaningful alerts and reduce time spent on routine or low-risk events.

The Data Security Posture Agent helps you reimagine how you discover and address data risks that are not obvious at first glance. Its core capabilities include:

• Natural-language queries – you can ask questions about your data security posture in everyday language to uncover risks that may be hidden behind complex context.
• Risk discovery – when the agent finds issues, it surfaces them as actionable insights rather than raw signals.
• Direct remediation – from those insights, you can apply sensitivity labels and trigger security policies immediately, without jumping between tools.

This approach helps you move from reactive investigation to proactive prevention of data loss, using the same Microsoft Purview environment you already rely on for data security and compliance.