Microsoft is continuing to strengthen Purview Data Security Investigations (DSI) by adding AI‑powered Optical Character Recognition (OCR) capabilities. This new enhancement allows DSI to read and analyze text that appears inside images, something traditional investigations often miss.
With OCR built in, DSI can now surface sensitive information hidden in screenshots, scanned documents, and embedded visuals within files. The result? Deeper investigations, better context, and more accurate risk detection across your organization.
This update is tracked under Microsoft 365 Roadmap ID 561489.
When is this rolling out?
- Public Preview (Worldwide):
Rolling out in late May 2026, with completion expected by early June 2026 - General Availability (Worldwide):
Rolling out in mid‑July 2026, with completion expected by late July 2026
Who is impacted?
This update is relevant for:
- Admins and security analysts using Microsoft Purview Data Security Investigations
- Organizations investigating data security risks with Purview
What’s changing?
Once OCR is enabled (and it will be on by default), DSI will automatically:
- Extract text from image‑based content, including:
- Images
- Screenshots
- Visuals embedded in documents
- Add the extracted text to investigation datasets
- Improve search, analysis, and risk detection using this newly visible content
The good news?
No workflow changes are required. Existing investigations will continue to work as they do today—just with richer insights.
Even better, all existing Purview controls and protections still apply. Sensitivity labels, DLP policies, and other compliance settings continue to be fully respected.
Why this matters
Sensitive information doesn’t always live in plain text. Credentials, personal data, or confidential details often end up in screenshots or images—especially in collaboration tools. OCR helps close that gap and gives security teams greater visibility into data risks that were previously hard to detect.
What do you need to do?
No action is required before rollout. However, you may want to:
- Inform your security and compliance teams about the improved image‑based detection
- Update internal investigation procedures to account for OCR‑driven findings
- Refresh training materials or documentation that reference DSI capabilities
