Cut through alert noise and focus on the risks that matter with Agents in Microsoft Purview.
Cut through alert noise and focus on the risks that matter with Agents in Microsoft Purview. Use Data Security Triage Agent to prioritize incidents, investigate user activity with full context, and uncover hidden patterns that signal real threats. Identify and act on high-risk behavior, like data exfiltration or persistent access, before it leads to data loss.
Detect sensitive data across your environment using natural language with Data Security Posture Agent. Analyze content to find what’s exposed, apply protections or restrict access, and surface hidden credentials, so you can take action and continuously reduce risk.
Michelle Slotwinski, Microsoft Purview Senior Product Manager, shares how to stay ahead of data risk by turning investigation into proactive protection.
Find it. Prioritize it. Fix it.
Investigate risks with the Data Security Posture + Triage Agents in Microsoft Purview. Start here.
From reactive to ready.
Uncover sensitive data, focus on what matters most, and reduce risk with the Data Security Posture and Triage Agents in Microsoft Purview. Take a look.
Reduce risks before they’re exposed.
Identify hidden passwords, API keys, and credentials buried in files with the Data Security Posture Agent credential scanning capability. Check it out.
QUICK LINKS:
00:00 — Reduce data risks
00:59 — Data Security Triage Agent
01:46 — Investigate risks
03:29 — Detect patterns
05:17 — Uncover nested insights
07:44 — Credential scanning
09:03 — Wrap up
Link References
https://aka.ms/AgentsinPurview
Unfamiliar with Microsoft Mechanics?
As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.
- Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
- Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
- Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast
Keep getting this insider knowledge, join us on social:
- Follow us on Twitter: https://twitter.com/MSFTMechanics
- Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
- Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
- Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics
Video Transcript:
-Data has always moved fast. What’s new is how many places it can show up and how fast tools like AI can surface it. In the next few minutes, I’ll show you how to rapidly identify and reduce your data risks as information flows across more apps, agents, and workflows than ever using the power and speed of AI itself. This is all made possible with the latest Data Security Agents in Microsoft Purview, which work alongside you to reduce the burden of managing the surge in risks from human and AI activity, enabling rapid identification of what truly needs your attention while enabling you to proactively perform deep content analysis to uncover sensitive data at risk, including credentials and secrets that may be deeply hidden within your data.
-And we are constantly evolving these agents to meet your everyday needs, removing manual work, and taking care of the busy work for you, while surfacing context-related insights based on their ability to deeply understand the data in your environment. In Microsoft Purview, you can explore agents from the left navigation. Like most analysts, I’ll start the day by reviewing alerts, and so I’ll begin with the Data Security Triage Agent. This agent can triage alerts for both Data Loss Prevention and Insider Risk Management.
-I’m interested in the ones for Insider Risk, so I’ll open it. Here are all my triaged alerts. And I can see the agent has triaged and prioritized my alert queue down from 200 alerts to 40 that need my attention. There’s more happening under the hood than it seems. Powered by new advanced AI reasoning, the Data Security Triage Agent can process tens of thousands of activity logs at scale to add context and boost investigation accuracy. In fact, you can now see this in the richer insights that are packed into every alert. To show you, I’ll click into this alert for a data leak associated with a departing employee and view details. First, the summary tells me why this alert is highly risky. It’s flagging a highly privileged departing user, a senior engineer in fact, because it’s observed their pattern of accessing, archiving, and exfiltrating both business and personal files using multiple methods. It’s highlighting key activities. Bulk archive to export data to removable media, observed external sharing to a SharePoint Online site, and Access to Sensitive Files.
-Notably, their last working day is recorded as March 31st and the alert was generated on March 27th, so we still have a few days to act before they leave our organization. Let’s dig in deeper into Bulk archive creation. The summary tells me that high-value engineering assets were included. The device and IP address are indicated along with the time this activity occurred: March 23rd. And although the agent hasn’t detected any sensitive information, it has discovered file sensitivity labels. Files have both been archived and copied to removable media. And under details, we can see file counts, names, and types. If we filter on this activity, there’s even more detail. We can see the mix of personal and business files that the engineer has taken. In fact, let’s dig into one of them. I’ll click into the top Engineering designs file where we can see even more detail about the activity, including who performed it with their UPN, jsmith, location details, device details, and more. So using the Data Security Triage Agent for Insider Risk saves time from manual investigations. It also helps prevent important details from falling through the cracks by catching less obvious patterns too.
-In this second pattern, Observed External User Added to SharePoint Online Site, the agent was able to pick up upon the fact that the tech-savvy engineer was able to establish persistence to SharePoint resources by adding their personal Gmail account as an external member of the SharePoint site. This way, they would still have access to team resources even if their work account was deprovisioned. By detecting this behavioral pattern, the agent can infer user intent, something that traditional signals alone would have missed, especially considering that content on the SharePoint site did not contain classic sensitive information or match existing classifiers that would normally trigger protection policies. So the agent helps catch those edge cases. It lays out its findings for your validation and escalates the alert to contain the risk. In fact, here’s how advanced AI reasoning works.
-Under the hood, instead of one monolithic agent, it’s designed to intelligently plan investigation tasks and orchestrate multiple specialized sub‑agents. Each sub‑agent is an expert in a distinct capability or skill domain to retrieve information like inferred user intent, decomposition of complex tasks, understanding compliance, as well as associated data risks, and more. Results are then presented as Triaged Alerts so that you can quickly see what is important in your environment. Now I mentioned that as an analyst, you’re in control of validating agent outputs and taking action. Let me show you what that experience looks like. You can quickly and easily filter the activities within a risk pattern. And then preview the content in line within the investigation so you don’t need to traverse your intranet to view files, like this SharePoint document to see why it was flagged. And ultimately, you’ll confirm if the agent findings are true positives.
-Next, our Data Security Posture Agent helps us to go further by uncovering nested insights for specific users, groups, or sites. And it lets you stay ahead of data risks by finding sensitive data across your estate through natural language discovery. It uses large language models for contextual analysis. And beyond simple keywords or classifiers, it identifies real risk based on the purpose and context of content, which is often deeply hidden within files. And it also recommends actions. If you recall, our Triage agent found a key insight. Our engineer user, jsmith, was observed downloading key files, like Engineering designs to his local device. Notably, the file wasn’t labeled. So next, I want to do a deep analysis of the content under his account using the Data Security Posture Agent. The first thing I need to do is scope the discovery to our user, Joshua Smith, and to their specific mailbox, which comprises their email, Teams chats, and Copilot interactions, and we’ll select Site to investigate their OneDrive.
-Next, I’ll prompt the Posture Agent. “Find me all the files for this user that contain engineering architecture designs, programming code, or technical documentation.” And this operation can take a few moments or hours depending on the amount of data that the agentic process needs to analyze. The agent performs deep content analysis, reasoning over the file content and going beyond keywords and pre-defined data types. It understands context and whether or not in this case, valuable architectural designs, code or technical specs are present and exposed. Once it’s complete, the Data Security Posture Agent summarizes the number of files that match the prompt I entered. It’s found 16 files, 4 of which are not labeled, so let’s dig in further and view insights. Notice it hasn’t found any email or Teams messages or Copilot interactions. And you can see at the top of the Engineering designs file is one of the files without a label. As I scroll, I can see another three unlabeled files below.
-Because the agent was able to deeply analyze the content within these files, it saved me from the manual effort of doing this myself. I can now take action by individually selecting these files and applying a label. I’ll choose this one for Highly confidential. This label will trigger a related policy to restrict downloading the files or external sharing to user accounts outside of our organization, like the user jsmith’s personal Gmail account that we uncovered before. Next, let’s dig further into the content. Let’s see if any of these files contain additional secrets, like passwords or credentials, that could further put us at risk in the wrong hands. For that, we’ll use the new credential scanning capability of the Data Security Posture Agent, which can autonomously surface credentials buried in data across your organization.
-The first thing I need to do is create a Credential Scanning Task. I’ll give it a name based on our scan and scope its data source to the Project Abacus SharePoint Site, which, if you remember, our user Joshua Smith had persistent access to via his personal Gmail account. And I can also provide more context because we want to see if he has hidden credentials in any of the content on this site that might give him access to other services and infrastructure.
-With the task created, the agent will now scan that site using the same AI analysis that powers our Data Security Investigations solution. When the agent completes its scan, if we review its results, you’ll see a prioritized list of exposed credentials, such as private keys, Entra credentials, and API tokens, each with a risk score and the agent’s reasoning. Once it’s finished, then it’s easy to review the agent’s findings and drill into source content to see the discovered credentials inline. And of course, from there, you can take action to disable access to files containing credentials.
-So, that’s how Data Security Agents in Microsoft Purview work alongside you to remove manual work for you, while surfacing hard-to-find context-related insights. And the good news is that if your organization has Microsoft 365 E5 or E7, you’ll have access to these agents included as part of your license. If not, they are also available on a consumption basis. To learn more and get started, check out aka.ms/AgentsinPurview. Keep watching Microsoft Mechanics for the latest tech updates, and thanks for watching.
