MC1481317 - Microsoft Purview | Insider Risk Management: Retirement of Data Risk Graph

Microsoft 365 Message Center announcement MC1481317.

MS Message Center's Summary

Microsoft is retiring the Data Risk Graph feature within Insider Risk Management by December 8, 2026. Policies and alerts remain fully functional, but visual investigation tools will no longer be accessible via this specific tab. Administrators should inform investigation teams about the upcoming removal and update internal standard operating procedures to direct staff towards Activity explorer, Content explorer, and User activity tools for ongoing reviews.

Administrator impact
Administrators must update internal documentation and redirect investigators to alternative tools before December 2026.
End user impact
Investigators will need to use alternative exploration tools for reviewing user activities and risk data.
Importance
4/10: This planned retirement requires workflow adjustments for investigators but causes no service disruption.

Data risk graph in Insider Risk Management

Investigate Microsoft Purview Insider Risk Management activities

Use reports in Insider Risk Management

Microsoft Summary

Microsoft Purview Insider Risk Management is retiring the Data Risk Graph by December 8, 2026. Users must transition to Activity explorer, Content explorer, and User activity experiences for investigations. Existing policies and workflows remain unaffected; no user action is required for the feature removal.

Message Center ID
MC1481317
Category
plan For Change
Severity
normal
Services
Microsoft Purview
Tags
User impact, Admin impact, Retirement
Published
2026-09-28
Last updated
2026-09-28
Expires
2027-01-08

[What and why] We are retiring Data Risk Graph in Microsoft Purview Insider Risk Management (IRM). Data Risk Graph provides a visual investigation experience that helps investigators review connections among impacted data, users, and alert-related activities. As part of ongoing investments in Insider Risk Management investigation experiences, we are retiring this capability and directing customers to alternative investigation tools that provide detailed activity timelines and investigative context. After retirement, investigators can continue reviewing potentially risky activity by using Activity explorer, Content explorer, and User activity experiences within Microsoft Purview Insider Risk Management. [Rollout schedule] For Worldwide, GCC, GCC High, DoD: The ability to configure Data Risk Graph was removed in early September 2026 New onboarding for Data Risk Graph ends September 24, 2026 Data Risk Graph retirement begins in early December 2026 and is expected to be fully retired by December 8, 2026 [Impact on your organization] Who is affected Microsoft Purview Insider Risk Management administrators Insider Risk Management investigators Organizations currently using the Data Risk Graph experience Platforms and services Microsoft Purview Insider Risk Management Web What will happen After retirement: The Data Risk Graph tab will no longer be available in Insider Risk Management alert details. Organizations will no longer be able to configure or begin using Data Risk Graph. Existing Insider Risk Management policies, alerts, cases, reports, and investigation workflows will remain available. Customers can continue to investigate potentially risky activity using Activity explorer, Content explorer, and User activity experiences. No changes will be made to existing Insider Risk Management policy configurations as a result of this retirement. No user action is required for feature disablement. The feature will be removed by Microsoft as part of the retirement process. [Action required and recommendations] Action is recommended if your organization currently uses Data Risk Graph. Notify Insider Risk Management administrators and investigators about this retirement. Review current investigation workflows that rely on the Data Risk Graph tab. Update internal documentation, training materials, and standard operating procedures that reference Data Risk Graph. Transition investigators to Activity explorer, Content explorer, and User activity experiences for investigation scenarios. Learn more Data risk graph in Insider Risk Management | Microsoft Learn Investigate Microsoft Purview Insider Risk Management activities | Microsoft Learn Use reports in Insider Risk Management | Microsoft Learn [Compliance considerations] No compliance considerations identified, review as appropriate for your organization.