Microsoft Purview DLP Gets Smarter Troubleshooting with Guided Diagnostics

If you’ve ever tried to troubleshoot why a Data Loss Prevention (DLP) policy behaved the way it did, you’ll know it’s not always obvious what happened behind the scenes. Microsoft is looking to change that.

Microsoft is rolling out a new guided diagnostics experience in Microsoft Purview Data Loss Prevention (DLP), designed to help administrators quickly understand, diagnose, and resolve DLP policy issues. The goal is simple: make DLP behavior easier to explain, easier to fix, and easier to optimize.

This update is tracked under Microsoft 365 Roadmap ID 561032.

When is this coming?
  • Public Preview: Mid‑May 2026 to Mid‑June 2026
  • General Availability (Worldwide): Late June 2026 to July 2026
Who does this affect?

This update is primarily aimed at:

  • Microsoft 365 administrators managing DLP policies in Microsoft Purview
  • Commercial Microsoft 365 tenants

If your organization has Microsoft 365 E5 and Copilot licensing, you’ll also benefit from Security Copilot‑powered insights, which add intelligent recommendations during troubleshooting.

What’s changing?

A new guided diagnostics experience will appear directly in the Microsoft Purview portal, making it much easier to understand what your DLP policies are doing and why.

With this experience, admins can:

  • See the order in which DLP policies are evaluated
  • Understand which conditions were matched
  • Clearly identify what action was taken (allow, block, or audit)

In other words, instead of guessing or piecing together logs, you’ll get a clearer, step‑by‑step explanation of how a DLP decision was made.

Security Copilot‑powered insights (for eligible tenants)

For organizations with the right licensing, Microsoft brings Copilot into the experience to help:

  • Spot potential policy misconfigurations
  • Speed up DLP troubleshooting
  • Get recommendations for improving and optimizing policies
What’s not changing?
  • Existing DLP policies continue to work exactly as they do today
  • Enforcement behavior is unchanged
  • There is no impact on end‑user workflows

This update is purely about visibility and diagnostics, not policy enforcement.

That said, you may want to:

  • Update internal DLP troubleshooting documentation to reference the new guided diagnostics experience
  • Make sure your security and compliance teams are aware of the new diagnostics flow in the Purview portal
  • Review your Copilot and E5 licensing to understand whether Security Copilot‑powered insights will be available in your tenant

Meet the New Cyber Heroes Crew: Morgi & Spot 🐾

🟣 Morgi: The AI Superhero

Morgi is the thinker of the Cyber Heroes Crew, the one who’s always quietly paying attention. Curious, clever, and powered by AI, she has a gift for noticing patterns that others overlook and figuring out what they mean before something goes wrong.

With her softly glowing purple shield by her side, Morgi keeps an eye on the digital world, catching phishing tricks, malware, and even deepfakes in seconds. She doesn’t just spot danger, she explains it in a way people can understand, helping them feel confident instead of overwhelmed.

At heart, Morgi wants everyone to feel safe and informed online. Her mission is simple: make technology smarter, friendlier, and safer for everyone who uses it.

Superpower: Seeing Ahead

Morgi’s strength comes from understanding, reading signals, connecting dots, and knowing what’s likely to happen next. By thinking ahead, she helps everyone stay one step ahead too.

🐾 When Morgi is watching, clarity replaces confusion.

🔵 Spot: The Cybersecurity Hero

Spot is the one who looks out for you when you’re busy, distracted, or just trying to get through your day. Quietly observant and steady by nature, Spot stays close, keeping watch over your data and devices so you don’t have to worry about every little thing online.

With his familiar blue shield always nearby, Spot steps in when something doesn’t feel right, blocking phishing attempts, stopping ransomware, and protecting personal information before it’s ever at risk. He doesn’t make a fuss about it. He just does what needs to be done.

Spot believes safety starts with small moments of awareness. A pause before clicking. A second look at an email. A gentle reminder that it’s okay to slow down. That simple “think before you click” mindset is how Spot helps people stay safe without feeling stressed or overwhelmed.

At the heart of it all, Spot’s role is simple and reassuring:
to stand beside you, quietly protecting your digital world, every step of the way.

What Makes Spot Special

Spot’s strength isn’t flash or noise—it’s presence. He’s patient, dependable, and always paying attention, so you can move through the online world with confidence.

🐾 When Spot is around, you’re not facing the internet alone.

Together

Morgi analyzes. Spot protects.
Side by side, they form the ultimate cybersecurity duo, keeping Jo SNAI’s digital world secure, intelligent, and one step ahead of every threat.

🚀 Stay tuned as Morgi & Spot dive into their next cyber adventure! 🐾🐾

Copilot Cowork is now available in Frontier

Copilot Cowork has officially landed in Frontier for Microsoft 365 Copilot (Premium) users. This release brings a more collaborative way for Copilot to work across apps, handling multi‑step tasks while keeping you in control.

With Copilot Cowork, tasks can span multiple Microsoft 365 apps, with clear user approvals along the way and built‑in progress tracking so you always know what’s happening. It’s designed to feel less like a single command and more like a coworker helping you get things done.

To use Copilot Cowork, users need to be enrolled in Frontier. It currently works with Microsoft‑built agents and uses Anthropic as a subprocessor. For customers in the EU, data boundary controls are in place to help meet regional compliance requirements.

The good news? No admin action is required to get started eligible users can simply explore the experience once Frontier is enabled.

When is this happening?

Copilot Cowork is already rolling out and is available today in Frontier.
General availability for all customers will be announced later—Microsoft will share details once it’s ready for broader release.

What this means for your organization

This update introduces a new way for Copilot to work alongside users—taking on longer, multi‑step tasks across Microsoft 365 apps while keeping people firmly in control. Think of it as Copilot stepping up from quick help to ongoing collaboration.

Who can use Copilot Cowork?

Copilot Cowork is available to:

  • Users with a Microsoft 365 Copilot (Premium) license
  • Users who are enabled for Frontier
  • English‑language users (for now)
Prerequisites and controls to be aware of

Before Copilot Cowork can be used, a few requirements need to be in place:

  • The tenant must be enrolled in the Frontier program
  • Microsoft‑built agents must be enabled
  • Anthropic must be enabled as a subprocessor (this is on by default)

For organizations based in the European Union (EU):

  • Anthropic is turned off by default to meet EU Data Boundary requirements
  • It must be explicitly enabled for Copilot Cowork to function
  • If Anthropic remains off, users may see Copilot Cowork listed but won’t be able to use it

Admins also need to be enrolled in Frontier to see Copilot Cowork listed in the Agent Inventory.

What users can expect

Once available, users can:

  • Install Copilot Cowork directly from the Agent Store in the Microsoft 365 Copilot app
  • Pin it to the left rail for easy access

From there, users can simply describe what they want to achieve—in plain, natural language—and Copilot Cowork will:

  • Create a multi‑step plan based on the user’s Microsoft 365 context
  • Coordinate work across apps like Word, PowerPoint, Outlook, and more
  • Continue working over time, with clear checkpoints and progress tracking

Importantly, Copilot Cowork never acts without permission. It will always propose actions first and wait for explicit user approval before doing things like:

  • Sending emails or Teams messages
  • Scheduling, declining, or rescheduling meetings
  • Editing, moving, or organizing files

Users stay in control at all times—they can pause, adjust, or stop execution whenever they want, and come back later to review progress.

Default behavior and governance

For eligible tenants, Copilot Cowork is enabled by default and respects existing Microsoft 365 permissions and policies. The only exception is where EU Data Boundary settings apply, which may limit functionality unless explicitly configured.

(Updated) Microsoft 365 Copilot: Graph APIs for agent and app management

Microsoft is rolling out two new Microsoft Graph APIs that make it much easier for administrators to discover, monitor, and manage Copilot agents and apps across their organization.

Instead of relying on manual checks through the admin UI, these new APIs allow admins to programmatically access a complete inventory of agents and apps. This opens the door to richer reporting, automation, and seamless integration with existing tools and workflows.

This update is tracked under Microsoft 365 Roadmap ID 502875.

When is this happening?
  • Frontier (Preview): Available now
  • General Availability (Worldwide):
    Deployment will start in mid‑April 2026 (previously end of March) and is expected to complete by early May 2026 (previously end of February).
How does this affect your organization?
Who is impacted?

This change is relevant for admins who manage Copilot agents and apps within Microsoft 365 environments.

What’s changing?

Microsoft is introducing new Graph API endpoints that provide visibility into all agents and apps in your tenant:

  • Retrieve all agents and apps GET graph.microsoft.com/copilot/admin/catalog/packages Returns a full inventory of Microsoft, External, Shared, and Custom agents and apps.
  • Retrieve details for a specific agent or app GET graph.microsoft.com/copilot/admin/catalog/packages/{id} Returns detailed metadata, including properties and manifest information.

These endpoints enable:

  • Automated reporting
  • Easier integrations with internal tools
  • Better visibility into what’s deployed across your organization
What’s not changing?
  • There are no changes to existing admin UI workflows
  • There are no changes to current policies
  • No additional licenses are required — the APIs are available with an existing Microsoft 365 license