{"id":15470,"date":"2026-03-19T08:01:25","date_gmt":"2026-03-18T23:01:25","guid":{"rendered":"https:\/\/m365jp.net\/?p=15470"},"modified":"2026-03-19T08:06:44","modified_gmt":"2026-03-18T23:06:44","slug":"mc1255406-microsoft-purview-data-security-triage-agent-summaries-for-dlp-alerts-in-microsoft-defender-xdr","status":"publish","type":"post","link":"https:\/\/m365jp.net\/index.php\/2026-03-19-mc1255406-microsoft-purview-data-security-triage-agent-summaries-for-dlp-alerts-in-microsoft-defender-xdr","title":{"rendered":"MC1255406 | Microsoft Purview | Data Security Triage Agent Summaries for DLP Alerts in Microsoft Defender XDR"},"content":{"rendered":"<div class=\"postie-post\">\n<div>\n<hr>\n<table id=\"section\">\n<tbody>\n<tr>\n<th width=\"95%\">MC1255406 | Microsoft Purview | Data Security Triage Agent Summaries for DLP Alerts in Microsoft Defender XDR<\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<table id=\"data\">\n<tbody>\n<tr>\n<th>Classification<\/th>\n<td>planForChange<\/td>\n<\/tr>\n<tr>\n<th>Last Updated<\/th>\n<td>03\/18\/2026 22:30:00<\/td>\n<\/tr>\n<tr>\n<th>Start Time<\/th>\n<td>03\/18\/2026 22:29:45<\/td>\n<\/tr>\n<tr>\n<th>End Time<\/th>\n<td>09\/29\/2026 07:00:00<\/td>\n<\/tr>\n<tr>\n<th>Message Content<\/th>\n<td>\n<p><b>[Introduction]<\/b><\/p>\n<p>  <\/p>\n<p>We\u2019re introducing <b>Data Security Triage Agent summaries and categorizations for Data Loss Prevention (DLP) alerts  <\/b>directly within the <b>Microsoft Defender XDR portal<\/b>. This update helps security analysts triage DLP alerts more efficiently by surfacing AI-generated summaries and categorizations created by the  <b>Microsoft Purview Data Security Triage Agent<\/b>.<\/p>\n<p>Screenshot 1: <i>Data Security Triage Agent outputs and summaries now available in DLP alerts in Microsoft Defender XDR<\/i><\/p>\n<p><img decoding=\"async\" style=\"width: 400px\" alt=\"user settings\" src=\"https:\/\/cxcs.microsoft.net\/file\/ccp\/en-us\/50c99607-4e2b-4535-99fb-62be7069f3d7\"><\/p>\n<p>This message is associated with Roadmap ID <a href=\"https:\/\/www.microsoft.com\/microsoft-365\/roadmap?filters=&amp;searchterms=558860\" target=\"_blank\">  558860<\/a>.<\/p>\n<p><b>[When this will happen:]<\/b><\/p>\n<ul>\n<li>Public Preview: We will begin rolling out <b>early April 2026 <\/b>and expect to complete by  <b>mid-April 2026<\/b>.<\/li>\n<li>  General Availability (Worldwide): We will begin rolling out <b>mid-August 2026<\/b> and expect to complete by  <b>late August 2026<\/b>.<\/li>\n<\/ul>\n<p><b>[How this affects your organization:]<\/b><\/p>\n<p><b>Who is affected:<\/b><\/p>\n<p>  <\/p>\n<ul>  <\/p>\n<li>Security analysts and admins triaging DLP alerts in Microsoft Defender XDR<\/li>\n<p>  <\/p>\n<li>Organizations using Microsoft Purview Data Security Triage Agent<\/li>\n<p>  <\/ul>\n<p><b>What will happen:<\/b><\/p>\n<p>  <\/p>\n<ul>  <\/p>\n<li>DLP alerts in Defender XDR will display <b>AI-generated summaries and categorizations<\/b> when the Agent is deployed.<\/li>\n<p>Screenshot 2: <i>Security Analysts and Admins triaging DLP alerts in Defenders will be able to deploy the Data Security Triage Agent from the Microsoft Defender XDR portal<\/i><\/p>\n<p><img decoding=\"async\" style=\"width: 400px\" alt=\"user settings\" src=\"https:\/\/cxcs.microsoft.net\/file\/ccp\/en-us\/920c32a9-6acc-4c6d-9533-ed198096d581\"><\/p>\n<p>  <\/p>\n<li>If the Agent is not deployed, eligible analysts can <b>deploy it from the DLP alert page<\/b> in Defender XDR.<\/li>\n<p>  <\/p>\n<li>Agent management (instructions, pause\/deactivate, usage monitoring) remains in Microsoft Purview.<\/li>\n<p>  <\/p>\n<li>Existing DLP policies and enforcement are <b>not changed<\/b>.<\/li>\n<p>  <\/p>\n<li>There is no impact to users.<\/li>\n<p>  <\/ul>\n<p><b>[What you can do to prepare:]<\/b><\/p>\n<p>  <\/p>\n<ul>  <\/p>\n<li>Deploy the <b>Data Security Triage Agent<\/b> in <b>Microsoft Purview <\/b>to enable summaries in Defender XDR.<\/li>\n<li>Review role assignments to ensure analysts who triage DLP alerts have the appropriate permissions.<\/li>\n<li>Update internal security operations documentation to reflect the new triage experience.<\/li>\n<li>Familiarize security teams with where Agent deployment can occur (Defender XDR) and where ongoing management is performed (Purview).<\/li>\n<p>  <\/ul>\n<p><b>Learn more: <\/b>Before rollout, we will update this post with new documentation.<\/p>\n<p><b>[Compliance considerations:]<\/b><\/p>\n<p>  <\/p>\n<table border=\"1\" cellpadding=\"6\" cellspacing=\"0\">  <\/p>\n<tbody>\n<tr>  <\/p>\n<th>Compliance area<\/th>\n<p>  <\/p>\n<th>Explanation<\/th>\n<p>  <\/tr>\n<p>  <\/p>\n<tr>  <\/p>\n<td>AI\/ML or agent capabilities interacting with customer data<\/td>\n<p>  <\/p>\n<td>This change introduces AI-generated summaries and categorizations for DLP alerts using the Microsoft Purview Data Security Triage Agent, which processes existing DLP alert data to assist analysts during triage.<\/td>\n<p>  <\/tr>\n<p>  <\/p>\n<tr>  <\/p>\n<td>Admin controls<\/td>\n<p>  <\/p>\n<td>Admins can deploy the Data Security Triage Agent from the Microsoft Defender XDR portal. Ongoing agent management, including custom instructions, pausing or deactivating the agent, and monitoring usage, remains available in the Microsoft Purview portal.<\/td>\n<p>  <\/tr>\n<p>  <\/p>\n<tr>  <\/p>\n<td>Admin monitoring and compliance reporting<\/td>\n<p>  <\/p>\n<td>The update enhances DLP alert investigations by adding AI-generated context, improving how admins monitor and assess data security incidents without changing underlying DLP policy enforcement or audit logging.<\/td>\n<p>  <\/tr>\n<p>  <\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<tr>\n<th>Machine Translation<\/th>\n<td>\n<p><b>[\u306f\u3058\u3081\u306b]<\/b><\/p>\n<p>  <\/p>\n<p><b>Microsoft Defender XDR\u30dd\u30fc\u30bf\u30eb<\/b>\u5185\u3067\u3001<b>\u30c7\u30fc\u30bf\u640d\u5931\u9632\u6b62(DLP)\u30a2\u30e9\u30fc\u30c8\u7528\u306e\u30c7\u30fc\u30bf\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c8\u30ea\u30a2\u30fc\u30b8\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u306e\u8981\u7d04\u3068\u5206\u985e<\/b>\u3092\u5c0e\u5165\u3057\u307e\u3059\u3002\u3053\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u306f\u3001<b>Microsoft Purview Data Security Triage Agent<\/b>\u306b\u3088\u3063\u3066\u4f5c\u6210\u3055\u308c\u305fAI\u751f\u6210\u306e\u8981\u7d04\u3084\u5206\u985e\u3092\u8868\u793a\u3059\u308b\u3053\u3068\u3067\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30ca\u30ea\u30b9\u30c8\u304cDLP\u30a2\u30e9\u30fc\u30c8\u3092\u3088\u308a\u52b9\u7387\u7684\u306b\u30c8\u30ea\u30a2\u30fc\u30b8\u3059\u308b\u3053\u3068\u3092\u53ef\u80fd\u306b\u3057\u307e\u3059\u3002<\/p>\n<p>\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c81:<i>Data Security Triage Agent\u306e\u51fa\u529b\u3068\u8981\u7d04\u304cMicrosoft Defender XDR\u306eDLP\u30a2\u30e9\u30fc\u30c8\u3067\u5229\u7528<\/i>\u53ef\u80fd\u306b\u306a\u308a\u307e\u3057\u305f<\/p>\n<p><img decoding=\"async\" style=\"width: 400px\" alt=\"user settings\" src=\"https:\/\/cxcs.microsoft.net\/file\/ccp\/en-us\/50c99607-4e2b-4535-99fb-62be7069f3d7\"><\/p>\n<p>\u3053\u306e\u30e1\u30c3\u30bb\u30fc\u30b8\u306f\u30ed\u30fc\u30c9\u30de\u30c3\u30d7ID <a href=\"https:\/\/www.microsoft.com\/microsoft-365\/roadmap?filters=&amp;searchterms=558860\" target=\"_blank\">  558860<\/a>\u306b\u95a2\u9023\u4ed8\u3051\u3089\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><b>[\u3044\u3064\u8d77\u3053\u308b\u304b:]<\/b><\/p>\n<ul>\n<li>\u516c\u958b\u30d7\u30ec\u30d3\u30e5\u30fc: <b>2026\u5e744\u6708\u521d\u65ec <\/b>\u304b\u3089\u5c55\u958b\u3092\u958b\u59cb\u3057\u3001 <b>2026\u5e744\u6708\u4e2d\u65ec<\/b>\u307e\u3067\u306b\u5b8c\u4e86\u3059\u308b\u4e88\u5b9a\u3067\u3059\u3002<\/li>\n<li>\u4e00\u822c\u516c\u958b(\u4e16\u754c\u5c55\u958b): <b>2026\u5e748\u6708\u4e2d\u65ec\u304b\u3089<\/b> \u5c55\u958b\u3092\u958b\u59cb\u3057\u3001 <b>8\u6708\u4e0b\u65ec<\/b>\u307e\u3067\u306b\u5b8c\u4e86\u3059\u308b\u4e88\u5b9a\u3067\u3059\u3002<\/li>\n<\/ul>\n<p><b>[\u3053\u308c\u304c\u3042\u306a\u305f\u306e\u7d44\u7e54\u306b\u3069\u306e\u3088\u3046\u306a\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u304b:]<\/b><\/p>\n<p><b>\u5f71\u97ff\u3092\u53d7\u3051\u308b\u4eba\u7269:<\/b><\/p>\n<p>  <\/p>\n<ul>  <\/p>\n<li>Microsoft Defender XDR\u3067DLP\u30a2\u30e9\u30fc\u30c8\u3092\u30c8\u30ea\u30a2\u30fc\u30b8\u3059\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30ca\u30ea\u30b9\u30c8\u3084\u7ba1\u7406\u8005<\/li>\n<p>  <\/p>\n<li>Microsoft Purview Data Security Triage Agent \u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u7d44\u7e54<\/li>\n<p>  <\/ul>\n<p><b>\u4eca\u5f8c\u306e\u5c55\u958b:<\/b><\/p>\n<p>  <\/p>\n<ul>  <\/p>\n<li>Defender XDR\u306eDLP\u30a2\u30e9\u30fc\u30c8\u306f\u3001\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u304c\u5c55\u958b\u3055\u308c\u308b\u3068 <b>AI\u751f\u6210\u306e\u8981\u7d04\u3084\u5206\u985e<\/b> \u3092\u8868\u793a\u3057\u307e\u3059\u3002<\/li>\n<p>\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c82: <i>Defenders\u3067DLP\u30a2\u30e9\u30fc\u30c8\u3092\u30c8\u30ea\u30a2\u30fc\u30b8\u3059\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30ca\u30ea\u30b9\u30c8\u3084\u7ba1\u7406\u8005\u306f\u3001Microsoft Defender XDR\u30dd\u30fc\u30bf\u30eb\u304b\u3089Data Security Triage Agent\u3092\u5c55\u958b\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059<\/i><\/p>\n<p><img decoding=\"async\" style=\"width: 400px\" alt=\"user settings\" src=\"https:\/\/cxcs.microsoft.net\/file\/ccp\/en-us\/920c32a9-6acc-4c6d-9533-ed198096d581\"><\/p>\n<p>  <\/p>\n<li>\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u304c\u672a\u5c55\u958b\u306e\u5834\u5408\u3001\u9069\u683c\u306a\u30a2\u30ca\u30ea\u30b9\u30c8\u306fDefender XDR\u306e <b>DLP\u30a2\u30e9\u30fc\u30c8\u30da\u30fc\u30b8\u304b\u3089\u5c55\u958b<\/b> \u3067\u304d\u307e\u3059\u3002<\/li>\n<p>  <\/p>\n<li>\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u7ba1\u7406(\u6307\u793a\u3001\u4e00\u6642\u505c\u6b62\/\u7121\u52b9\u5316\u3001\u4f7f\u7528\u72b6\u6cc1\u76e3\u8996)\u306fMicrosoft Purview\u306b\u6b8b\u3063\u3066\u3044\u307e\u3059\u3002<\/li>\n<p>  <\/p>\n<li>\u65e2\u5b58\u306eDLP\u30dd\u30ea\u30b7\u30fc\u3084\u57f7\u884c\u306f <b>\u5909\u66f4\u3055\u308c\u307e\u305b\u3093<\/b>\u3002<\/li>\n<p>  <\/p>\n<li>\u30e6\u30fc\u30b6\u30fc\u306b\u306f\u5f71\u97ff\u304c\u3042\u308a\u307e\u305b\u3093\u3002<\/li>\n<p>  <\/ul>\n<p><b>[\u6e96\u5099\u306e\u305f\u3081\u306b\u3067\u304d\u308b\u3053\u3068:]<\/b><\/p>\n<p>  <\/p>\n<ul>  <\/p>\n<li><b>Microsoft Purview<\/b>\u3067<b>Data Security Triage Agent<\/b>\u3092\u5c55\u958b\u3057\u3066\u3001Defender XDR\u3067\u30b5\u30de\u30ea\u30fc\u3092\u6709\u52b9\u306b\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/li>\n<li>DLP\u30a2\u30e9\u30fc\u30c8\u306e\u30c8\u30ea\u30a2\u30fc\u30b8\u3092\u884c\u3046\u30a2\u30ca\u30ea\u30b9\u30c8\u304c\u9069\u5207\u306a\u6a29\u9650\u3092\u6301\u3063\u3066\u3044\u308b\u304b\u3092\u78ba\u8a8d\u3059\u308b\u305f\u3081\u306b\u3001\u5f79\u5272\u5272\u308a\u5f53\u3066\u3092\u78ba\u8a8d\u3057\u307e\u3057\u3087\u3046\u3002<\/li>\n<li>\u5185\u90e8\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u904b\u7528\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u65b0\u3057\u3044\u30c8\u30ea\u30a2\u30fc\u30b8\u4f53\u9a13\u3092\u53cd\u6620\u3057\u3066\u66f4\u65b0\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/li>\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30fc\u30e0\u306b\u3001\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u5c55\u958b\u304c\u884c\u308f\u308c\u308b\u5834\u6240(Defender XDR)\u3068\u7d99\u7d9a\u7684\u306a\u7ba1\u7406\u304c\u884c\u308f\u308c\u308b\u5834\u6240(Purview)\u3092\u628a\u63e1\u3055\u305b\u307e\u3057\u3087\u3046\u3002<\/li>\n<p>  <\/ul>\n<p><b>\u8a73\u3057\u304f\u306f\u3053\u3061\u3089: <\/b>\u5c55\u958b\u524d\u306b\u3001\u65b0\u3057\u3044\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3067\u3053\u306e\u6295\u7a3f\u3092\u66f4\u65b0\u3057\u307e\u3059\u3002<\/p>\n<p><b>[\u30b3\u30f3\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u4e0a\u306e\u8003\u616e\u4e8b\u9805:]<\/b><\/p>\n<p>  <\/p>\n<table border=\"1\" cellpadding=\"6\" cellspacing=\"0\">  <\/p>\n<tbody>\n<tr>  <\/p>\n<th>\u30b3\u30f3\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u5206\u91ce<\/th>\n<p>  <\/p>\n<th>\u8aac\u660e<\/th>\n<p>  <\/tr>\n<p>  <\/p>\n<tr>  <\/p>\n<td>AI\/ML\u3084\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u306e\u6a5f\u80fd\u304c\u9867\u5ba2\u30c7\u30fc\u30bf\u3068\u3084\u308a\u53d6\u308a\u3059\u308b<\/td>\n<p>  <\/p>\n<td>\u3053\u306e\u5909\u66f4\u306b\u3088\u308a\u3001Microsoft Purview Data Security Triage Agent\u3092\u7528\u3044\u3066AI\u751f\u6210\u306eDLP\u30a2\u30e9\u30fc\u30c8\u306e\u8981\u7d04\u3068\u5206\u985e\u304c\u5c0e\u5165\u3055\u308c\u3001\u65e2\u5b58\u306eDLP\u30a2\u30e9\u30fc\u30c8\u30c7\u30fc\u30bf\u3092\u51e6\u7406\u3057\u3001\u30c8\u30ea\u30a2\u30fc\u30b8\u4e2d\u306e\u30a2\u30ca\u30ea\u30b9\u30c8\u3092\u652f\u63f4\u3057\u307e\u3059\u3002<\/td>\n<p>  <\/tr>\n<p>  <\/p>\n<tr>  <\/p>\n<td>\u7ba1\u7406\u7ba1\u7406<\/td>\n<p>  <\/p>\n<td>\u7ba1\u7406\u8005\u306fMicrosoft Defender XDR\u30dd\u30fc\u30bf\u30eb\u304b\u3089\u30c7\u30fc\u30bf\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c8\u30ea\u30a2\u30fc\u30b8\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u3092\u5c55\u958b\u3067\u304d\u307e\u3059\u3002\u30ab\u30b9\u30bf\u30e0\u6307\u793a\u3001\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u306e\u4e00\u6642\u505c\u6b62\u3084\u7121\u52b9\u5316\u3001\u4f7f\u7528\u72b6\u6cc1\u306e\u76e3\u8996\u306a\u3069\u3001\u7d99\u7d9a\u7684\u306a\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u7ba1\u7406\u306fMicrosoft Purview\u30dd\u30fc\u30bf\u30eb\u3067\u5f15\u304d\u7d9a\u304d\u5229\u7528\u53ef\u80fd\u3067\u3059\u3002<\/td>\n<p>  <\/tr>\n<p>  <\/p>\n<tr>  <\/p>\n<td>\u7ba1\u7406\u8005\u306e\u76e3\u8996\u3068\u30b3\u30f3\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9\u5831\u544a<\/td>\n<p>  <\/p>\n<td>\u3053\u306e\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u306f\u3001AI\u751f\u6210\u306e\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8\u3092\u8ffd\u52a0\u3059\u308b\u3053\u3068\u3067DLP\u30a2\u30e9\u30fc\u30c8\u8abf\u67fb\u3092\u5f37\u5316\u3057\u3001\u7ba1\u7406\u8005\u304c\u30c7\u30fc\u30bf\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u3092\u76e3\u8996\u30fb\u8a55\u4fa1\u3057\u3001\u57fa\u76e4\u3068\u306a\u308bDLP\u30dd\u30ea\u30b7\u30fc\u306e\u57f7\u884c\u3084\u76e3\u67fb\u30ed\u30b0\u3092\u5909\u66f4\u3059\u308b\u3053\u3068\u306a\u304f\u6539\u5584\u3057\u307e\u3059\u3002<\/td>\n<p>  <\/tr>\n<p>  <\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>MC1255406 | Microsoft Purview | Data Security Triage Agent Summaries for DLP Alerts in Microsoft Defender XDR  [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-15470","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/15470","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/comments?post=15470"}],"version-history":[{"count":0,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/15470\/revisions"}],"wp:attachment":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/media?parent=15470"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/categories?post=15470"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/tags?post=15470"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}