21.3 Respond to Purview Alerts in Microsoft Defender XDR

Microsoft Defender XDR is the SOC-facing console at security.microsoft.com where Purview DLP and Insider Risk Management alerts land next to endpoint, email, identity, and cloud-app detections. For SC-401, the skill is not "replace Purview with Defender." It is knowing how Purview alerts appear as Defender incidents, which filters and actions exist only in Defender, how status mapping works (especially for IRM), and how administrative units and data sharing constrain the view. Microsoft Defender for Cloud Apps file policy alerts and eDiscovery searches are the next chapter.

Why Purview alerts show up in Defender

For DLP, when the tenant is licensed and eligible, DLP alerts automatically flow into Microsoft Defender. Qualifying subscriptions Microsoft lists include Microsoft Office 365 E5/A5, Microsoft 365 E5/A5, Microsoft 365 E5/A5 Compliance, and Microsoft 365 E5/A5 Information Protection and Governance. If you do not want that automatic flow, you open a support case to disable it. If automatic flow is disabled, DLP alerts still surface in the Defender portal as Microsoft Defender for Office alerts—so "I turned DLP off in Defender" is not the same as "DLP disappeared."

From Incidents & alerts > Incidents you can view DLP alerts grouped under incidents, see DLP alerts correlated with other DLP alerts or with other solutions (Defender for Endpoint, Defender for Office 365, Microsoft Sentinel, and so on), hunt across compliance and security logs in Advanced hunting, take in-place remediation on users, files, and devices, tag incidents, and filter the unified queue by DLP policy name, tag, date, service source, incident status, and user.

For Insider Risk Management, the value Microsoft emphasizes is a unified view of all alerts related to a user, so a SOC analyst can correlate IRM with DLP and Microsoft Entra ID under one incident, see devices involved, hunt the user's activities, and open the user entity page for an insider-risk activity summary and risk level. Data sharing must be turned on in IRM settings (Share user risk details with other security solutions / share alert severity). That is the same family of settings that unlocks the DLP User activity summary tab in Purview.

Updates to an IRM alert—status, severity, activity that generated the alert, trigger information, and classification—sync both directions and are reflected in both portals within 30 minutes of generation or update.

Find the right queue and the right incident

Microsoft Learn currently describes two DLP filter labels depending on the article: Service source: Data Loss Prevention, and Service/detection sources → Microsoft Data Loss Prevention. On the exam, pick the DLP service/detection source, not "Microsoft Defender for Endpoint" and not a custom detection. You can also filter by Entities (user and device names) and Policy/policy rule, and search file names, users, devices, and file paths. In preview, Alert policies > Alert policy title lets you search on the DLP policy name.

For IRM, filter incidents and the alert queue by service source Microsoft Purview Insider Risk Management. IRM alerts related to a user are correlated into a single incident so the SOC sees one user-centric story.

Administrative units restrictions flow from DLP into the Defender portal. An AU-restricted admin sees only DLP alerts for that administrative unit. Do not assume a Security Operator in a regional AU can triage another region's SharePoint DLP incident.

Open the incident summary, then the DLP or IRM alert. Summarize (preview) / Security Copilot on a DLP alert returns severity, title, matched policy name, file name and link, status, and the actor's email—the same summary shape as Purview.

Status mapping: do not resolve blindly

Defender and Purview DLP do not publish a one-row status dictionary the way IRM does. In Purview you can set a DLP alert to Investigating and then Resolved. Defender alert status values are New, In progress, and Resolved, with classifications such as true positive, informational/expected activity, and false positive. Treat the portals as two views of the same DLP work: finish investigation, then resolve and document. Do not invent a DLP mapping table Microsoft has not published.

IRM is different. Microsoft does publish the mapping because the two products use different frameworks:

Exam trap: a SOC analyst marks an IRM alert Resolved in Defender without a true-positive classification. Purview can show Dismissed, not Confirmed, and you never opened a case. Conversely, confirming in Purview should not be undone in Defender by resolving as false positive. IRM alert notes do not sync to Defender, so the justification you typed in Purview is not the Defender comment thread.

Alerts created from custom detections or from linking query results to incidents are not available in the Purview portal. Do not expect a hunting-driven Defender alert to appear on the IRM Alerts dashboard.

Microsoft also lists IRM data not yet available in this integration: exfiltration through email events, risky AI usage events, third-party cloud apps events, events that occurred before the alert was generated, and administrator-defined event exclusions. Insider risk management incidents do not contain alerts currently, which can break Microsoft Sentinel automations that assume every incident has alert content. Microsoft recommends the Microsoft Purview Insider Risk Management – Microsoft Sentinel data connector for Sentinel, and documents turning off IRM data sharing as a mitigation if automation fails for empty IRM incidents.

Investigate and remediate in the Defender portal

DLP alert page. Read the Alert story for the policy and the sensitive information types. Select a related event for user-activity details. With the content-viewer permission, open Sensitive info types for matched content and Source for file content.

Go Hunt (preview) from an event offers built-in advanced hunting queries for that location. For a SharePoint event Microsoft lists File shared with, File activities, Site activity, and User DLP violations for last 30 days. Run immediately, change the time range, edit, or save. Advanced hunting for DLP explores up to 30 days of audit logs. The CloudAppEvents table holds audit logs across SharePoint, OneDrive, Exchange, and devices; you must have access to that table (Microsoft 365 connected for Defender for Cloud Apps / hunting) before those queries return DLP data.

In-place DLP actions. For email: Actions > Download email (subject to the deleted-message limits from 21.1). For SharePoint or OneDrive files: apply a retention label, unshare, delete, apply a sensitivity label, download (data classification content viewer required), and withdraw feedback. Select the user card for identity actions such as reset password or disable account. Select the device card for device DLP alerts to isolate, collect an investigation pack, run an antivirus scan, or quarantine a file. On the incident summary, Manage incident adds tags, assigns, or resolves the incident.

Defender's broader remediation catalog (also listed in the DLP investigation Learn article) includes view user activity, remove document, download file, disable user, delete email, and move mail to another folder. Use the action that matches the asset in the alert; isolating a device does not unshare a SharePoint link.

IRM in Defender. Hunt with AlertInfo and AlertEvidence (IRM alerts among other Microsoft security alerts), DataSecurityBehaviors (suspicious behavior that violates default or customer Purview policies), and DataSecurityEvents (enriched events for those violations). Access to IRM data in advanced hunting requires Insider Risk Management Analyst or Insider Risk Management Investigator. Microsoft Graph security API integration uses incidents (read/write), alerts (read/write), and advanced hunting (read). Customers on the Office 365 Management Activity API are directed to migrate to Microsoft Graph security API for richer metadata and bi-directional IRM support.

Roles in the Defender portal

Grant least privilege. Microsoft's DLP table:

For IRM alerts in Defender you need a Defender role of Security Operator or Security Reader and membership in Insider Risk Management, Insider Risk Management Analysts, or Insider Risk Management Investigators.

Turn on alerts for DLP policies in Purview before you expect a full Defender queue. Then investigate in Defender when you need correlation, 30-day hunting, or in-place containment; return to Purview when you need Investigating status, a shareable DLP event link, IRM Activity explorer, or case-and-notice workflow.