In this article, we'll look at three upcoming Microsoft Purview changes that may be worth adding to your watchlist over the coming months.
Archive SharePoint content through retention policies
Retention policies in Microsoft Purview Data Lifecycle Management are getting a new action: archive. Instead of keeping retained SharePoint and OneDrive content in active storage, administrators can move inactive files to Microsoft 365 Archive directly through retention policies.
This is not enabled by default and requires existing retention policies to be updated. Archived content remains available for compliance scenarios, including eDiscovery, while reducing the amount of content kept in active storage.
One detail that caught my attention is the Copilot integration. Archived content is excluded from Copilot indexing, meaning retained historical content moved to Microsoft 365 Archive will no longer be considered when generating responses. For organizations with large volumes of legacy content, this could help keep Copilot focused on more current information.
Rollout is expected to begin in early October 2026 and complete by early November 2026. Microsoft originally targeted September before revising the timeline. As always, Microsoft timelines may change.
How to prepare:
Review existing retention policies and identify areas where inactive content could be archived rather than retained in active storage. Compliance and records management teams should also understand how archived content remains available for eDiscovery while being excluded from Copilot indexing.
More information:
Permanently delete content despite retention policies and holds
Microsoft Purview Data Lifecycle Management is introducing a new priority cleanup workflow that allows administrators to permanently delete specific content types in SharePoint Online and OneDrive, even when retention policies or holds are in place.
A new Delete data permanently action can be configured within a priority cleanup policy, resulting in a hard delete of the targeted content. Once deleted, the content is removed from SharePoint search, Copilot experiences, and eDiscovery. For content under hold, an eDiscovery administrator must review and approve the deletion before it can proceed.
In practice, this creates a governed process for removing content that would otherwise remain protected by retention policies or holds. The capability is not enabled by default and requires administrators to create and configure priority cleanup policies in Purview.
Rollout is expected to begin in mid-October 2026 and complete by mid-November 2026. Microsoft originally targeted September before updating the timeline. The feature is associated with Microsoft 365 Roadmap ID 558343.
How to prepare:
Review existing retention and legal hold processes to determine whether there are scenarios where permanent deletion may be required. Organizations should also ensure appropriate eDiscovery review and approval procedures are in place before introducing priority cleanup policies.
More information:
Unified alert triage arrives in Insider Risk Management
Insider Risk Management is getting a new unified alert triage experience that brings Data Security Triage Agent insights directly into the standard Alerts queue. Instead of switching between separate views, analysts will be able to review alert details, agent-generated summaries, user details, and prioritization information from a single workspace.
Agent categorization is also surfaced directly in the alert queue, reducing the amount of context switching required during triage. Existing Insider Risk Management policies, privacy controls, pseudonymization settings, role-based permissions, and auditing capabilities remain unchanged. As part of the transition, Alert Spotlight will be retired and the existing toggle between classic and agent-based alert views will be removed.
Rollout is expected to begin in early October 2026 and complete by mid-October 2026. A transition period will allow both the classic and new experiences to remain available before the classic experience is retired. The feature is associated with Microsoft 365 Roadmap ID 564621.
How to prepare:
Organizations using Insider Risk Management should review current investigation workflows and ensure analysts understand the new agent categorization, alert summaries, and filtering capabilities. Any internal documentation or training material referencing Alert Spotlight, separate Triage Agent dashboards, or the existing alert toggle should also be updated before the classic experience is retired.
More information:
While these updates cover different parts of Purview, they all point in the same direction. Administrators are getting more control over how information is retained, archived, investigated, and ultimately removed when business or compliance requirements demand it.
The addition of archive actions in retention policies, the new priority cleanup workflow, and a more streamlined Insider Risk Management experience are all worth keeping an eye on as they roll out over the coming months. If you're responsible for governance, compliance, or records management, now is a good time to review existing processes and make sure they're still aligned with how Microsoft wants these workloads to operate going forward.
Thanks for reading. If you'd like to stay up to date with Microsoft 365, Copilot, Teams, security, compliance, and AI-related announcements, you can follow me on LinkedIn.
Comments