Podcast Episode: DSI Investigation templates for common data security scenarios

Posted on June 11, 2026 by Jo SNAI

🎙️ New podcast episode just dropped!
DSI Investigation Templates for Common Data Security Scenarios with Pip & Mara
▶️ Watch now on YouTube

Stay tuned…

Microsoft Purview DSI Gets Smarter with OCR

Posted on May 6, 2026 by Jo SNAI

Microsoft is continuing to strengthen Purview Data Security Investigations (DSI) by adding AI‑powered Optical Character Recognition (OCR) capabilities. This new enhancement allows DSI to read and analyze text that appears inside images, something traditional investigations often miss.

With OCR built in, DSI can now surface sensitive information hidden in screenshots, scanned documents, and embedded visuals within files. The result? Deeper investigations, better context, and more accurate risk detection across your organization.

This update is tracked under Microsoft 365 Roadmap ID 561489.

When is this rolling out?

Public Preview (Worldwide):
Rolling out in late May 2026, with completion expected by early June 2026
General Availability (Worldwide):
Rolling out in mid‑July 2026, with completion expected by late July 2026

Who is impacted?

This update is relevant for:

Admins and security analysts using Microsoft Purview Data Security Investigations
Organizations investigating data security risks with Purview

What’s changing?

Once OCR is enabled (and it will be on by default), DSI will automatically:

Extract text from image‑based content, including:
- Images
- Screenshots
- Visuals embedded in documents
Add the extracted text to investigation datasets
Improve search, analysis, and risk detection using this newly visible content

The good news?
No workflow changes are required. Existing investigations will continue to work as they do today—just with richer insights.

Even better, all existing Purview controls and protections still apply. Sensitivity labels, DLP policies, and other compliance settings continue to be fully respected.

Why this matters

Sensitive information doesn’t always live in plain text. Credentials, personal data, or confidential details often end up in screenshots or images—especially in collaboration tools. OCR helps close that gap and gives security teams greater visibility into data risks that were previously hard to detect.

What do you need to do?

No action is required before rollout. However, you may want to:

Inform your security and compliance teams about the improved image‑based detection
Update internal investigation procedures to account for OCR‑driven findings
Refresh training materials or documentation that reference DSI capabilities

Data Security Investigations introduces new soft purge mitigation action

Posted on March 15, 2026 by Jo SNAI

Microsoft is introducing a new soft purge action in Data Security Investigations (DSI), giving admins a quick and safe way to remove sensitive or overshared files during an investigation. With soft purge, items can be deleted immediately but still recovered later as long as they’re within their deleted‑item retention period, so admins get speed without risking permanent data loss.

This builds on DSI’s growing set of AI‑powered tools like intelligent categorization, AI search, and automated risk insights making it easier than ever for organizations to spot issues and take action fast.

New update coming to Microsoft 365 Roadmap ID 558109. A soft purge action will soon be available in Data Security Investigations (DSI), giving admins a safer and more flexible way to remove sensitive or overshared content during an investigation.

When it’s rolling out

General Availability (Worldwide): Begins early April 2026
Expected completion: late May 2026

What this means for your organization

Who is affected?

Admins who use Data Security Investigations (DSI) in the Microsoft Purview compliance portal.

What’s changing

A new soft purge option will appear in DSI. With this action, admins can:

Remove items that match an investigation query
Keep those items recoverable until the retention period expires
Act quickly without risking accidental permanent deletion

And the best part:

The feature is on by default
No configuration needed
No changes to existing DLP, labeling, or retention policies
End users will not see any changes in their workflows

Once the rollout finishes, the feature simply appears for eligible tenants.

How to prepare

There is nothing you need to do in advance.
If you want to get ahead, you may consider:

Reviewing how soft purge works in DSI
Updating any internal guidance on investigation processes
Informing your security or compliance teams about the new action

Overall, this update gives organizations a safer and more controlled way to remove sensitive content during investigations—without adding extra steps or complexity.

Empowering Cybersecurity with Microsoft Purview Data Security Investigations (Preview)

Posted on October 22, 2025 by Jo SNAI

Data Security Investigations (preview) workflow helps you quickly identify, investigate, and take action on data associated with security and data breach incidents. This workflow isn’t a linear process. It includes significant iteration requirements for several of the steps to fine tune searches, evidence gathering, classification, and investigation by using AI and activities.

Analysts can use Data Security Investigations (preview) features in your organization to:

Quickly and efficiently search, discover, and identify impacted data.
Use deep content AI analysis to discover exact data risks hidden in data.
Take action to reduce the impact of data security incidents and quickly mitigate ongoing risks.
Collaborate with internal and external stakeholders on investigation details.

Check out the following videos to learn about how Data Security Investigations (preview) can help you respond to data security incidents:

DSI builds on and extends Microsoft Purview’s existing best-of-breed Data Security portfolio. Our information protection, data loss prevention, and insider risk management solutions have provided customers with a strong foundation to protect their crown jewels, their data. Data is at the center of cyberattacks, and now DSI will use AI to re-imagine how customers investigate and mitigate data security incidents, accelerating the process dramatically. Most organizations we spoke to (77%) believe that AI will accelerate data security detection and response, and 76% think AI will improve the accuracy of data security detection and response strategies. With its cutting edge, generative AI-powered investigative capabilities, DSI will transform and scale how data security admins analyze incident-related data. DSI uncovers key security and sensitive data risks and facilitates secure collaboration between partner teams to mitigate those identified risks. This simplifies previously complex, time-consuming tasks – what once took months, can now be done in a fraction of the time.