Microsoft is cleaning house in Purview Insider Risk Management. On August 31, 2026, two familiar features disappear: the alert spotlighting experience and the agent/classic alert toggle. If your IRM policies are running, this affects your day-to-day operations — and the clock is real.
Between now and then, both the old and new experiences stay live. That 60-day overlap is your window to learn the new workflow before it becomes the only one. Here’s what lands, what goes, and what to do before the deadline.
What Ships: Three Features, One Queue
July 2026 brings a redesigned alert experience to public preview. Three things arrive together:
Unified alert queue
The classic alert view and the Data Security Triage Agent summaries merge into a single queue. Alert summaries appear inline, so you see the agent’s reasoning right next to the signal. Filtering is combined across both sources, and a new Categorization column helps you sort by type without opening each alert. Roadmap ID: 564621.
Entra ID profile enrichment
Each alert profile now pulls directly from Entra ID: office location, employee type, department, and last working date. Analysts also see aggregated alert and case history, priority user group membership, and which policies apply to that person. The result is faster context without tab-switching to Entra or other portals. Note: pseudo-anonymization overrides this — a privacy-by-design behavior that keeps anonymized users from being re-identified. Roadmap ID: 564619.
Persistent notes
Both system-generated and analyst-written notes now stick to alerts and cases across sessions. System notes capture triage decisions and policy triggers automatically. Analyst notes let you document your reasoning without it disappearing when the case closes. This closes a long-standing gap in investigation continuity. Roadmap ID: 564620.
What Gets Retired August 31, 2026
Alert spotlighting — the dedicated classic alert experience — goes away. So does the agent/classic toggle that switched between the two views. After Aug 31, the unified queue is it. No toggle, no classic fallback. The 60-day overlap period (roughly July through August) means both paths work simultaneously, but only for now.
What to Do Before August 31
Test the new experience before it becomes mandatory. Walk your analyst team through the unified queue with real alerts. Check the Entra enrichment on a few high-priority users. Try writing and reading persistent notes on active cases. Any workflows built around the classic spotlighting view need to be updated — document those gaps while both experiences are still available.
Direct link: aka.ms/NewIRMAlertExperienceInProduct
Bottom Line
The unified alert experience is a net improvement — better context, combined views, notes that persist. But a migration is a migration. The Aug 31 deadline is firm, and the 60-day overlap is your safety net. Use it.
