Microsoft Purview Data Security Investigations: What It Does, When to Use It, and What It Costs

Data Security Investigations (DSI) is a Microsoft Purview solution for the hours and days after a data security incident. An investigator creates an investigation, pulls the impacted content into it, lets AI analysis classify and summarize what is there, reviews the findings, and then acts on the data and writes the report. Microsoft's overview describes the loop as search and identify the impacted data, use AI analysis to find risks inside it, and take action, including soft and hard purges that remove or permanently delete items from the data sources.

The investigation can start from several places. Microsoft's documentation lists Microsoft Defender XDR incidents, Insider Risk Management cases and Data Security Posture Management insights as entry points that open an investigation with the relevant items already scoped. Audit search adds content based on unified audit log activity, which is how an investigator sees who accessed, shared or downloaded what. Endpoint DLP evidence is a newer data source and is in preview. In the workspace, AI deep content analysis categorizes the collected items, flags the ones that carry sensitive data (financial, personal, health, credentials, contracts) and produces summaries an investigator can read instead of opening files one by one.

The output is a scoped set of findings: which items were in the exposure, which of them matter, which identities were involved, and a record of what was purged. That is the input to the breach notification decision and to the post-incident report.

The three Purview tools overlap in the collection step and differ in everything else.

In practice they chain. Insider Risk Management raises a case about a departing employee's downloads; the investigator opens a DSI investigation from that case to see what was in the files; legal opens an eDiscovery case if the matter becomes a dispute. eDiscovery in Microsoft 365 covers the legal tool, and Microsoft Purview Insider Risk Management Implementation ($4,950 per project) builds the policies that feed it.

1. A departing employee copied a folder. Insider Risk Management or Defender for Cloud Apps shows 1,800 downloads in an afternoon. DSI answers whether the folder held customer records or lunch menus, and which items need a purge request or a letter from counsel.
2. A SharePoint site was overshared. An anyone link, a site made public, or a Copilot query that surfaced a file it should not have (see Copilot oversharing). DSI scopes the items reachable through the link, categorizes them and uses audit activity to show whether anyone outside the firm opened them.
3. A mailbox was compromised. After the account is contained, the question is what the attacker could read. DSI pulls the mailbox content for the exposure window and classifies it, which is what the notification decision rests on. Business Email Compromise Investigation and Recovery does the containment and the timeline; DSI is the content-analysis step inside it.
4. A regulator or insurer asks which categories of data were affected. Breach notification laws turn on data categories and counts. DSI's categorization produces those counts from the actual items rather than from a guess.

Decision rule: if the incident is about content (what was in the data), use DSI; if it is about a person's pattern of behavior, start in Insider Risk Management; if it is about legal preservation, start in eDiscovery. If your tenant got breached, what evidence would you have covers the logging that has to exist first.

Microsoft's documentation states that you do not need a dedicated enterprise plan or license to use Data Security Investigations. What you do need is billing in place and the right roles.

• An Azure subscription in the same tenant as Purview, and a resource group in it. The pay-as-you-go charges land there. If the tenant already set up an Azure subscription for other pay-as-you-go Purview features, the same one serves DSI.
• Global Administrator plus Owner or Contributor on the resource group to configure billing. Microsoft recommends the roles with the fewest permissions that still complete the task.
• Data Security Investigations Admins role group to configure the AI capacity; Investigators and Reviewers role groups for the people who run and read investigations.
• Security Administrator and Security Operator roles to open an investigation from the Defender portal; an Insider Risk Management role for investigations opened from an IRM case.

The tools that feed DSI are per-user licensed. On the October 2026 price list: Microsoft Purview Suite is $12.00 per user per month ($144.00 per year), Microsoft 365 E5 Insider Risk Management $6.00, Microsoft 365 E5 eDiscovery and Audit $6.00, the Purview Suite for Microsoft 365 Business Premium $10.00, and Microsoft 365 E5 $60.00 (Microsoft list price, October 2026 price list). Which of those an E3 tenant needs is worked through in E5 Security and E5 Compliance add-ons vs full E5.

DSI uses Microsoft Purview's pay-as-you-go model. Microsoft's billing page describes two meters: a storage meter for the data held in investigations, and AI capacity measured in compute units consumed per hour of analysis. Monthly charges are the amount of data stored plus the number of compute units used. Microsoft publishes the rates for Data Security Investigations Compute (per compute unit per hour) and Data Security Investigations Storage (per GB per month) on the Azure pricing page for Microsoft Purview; the rate is Microsoft's and is billed to your Azure subscription, so read that page for the current figure before you set a budget.

Four billing rules from Microsoft's documentation shape how you run an investigation:

• You pay only for the compute units you use; there is no reservation.
• Failed operations are not billed. Partial completions are, and if you cancel a job in progress you still pay for the compute consumed before the cancellation.
• Before configuring billing, the estimate costs tool in Purview projects the monthly storage and AI cost from the data volume you expect.
• The Azure subscription you configure covers every pay-as-you-go Purview capability, not only DSI.

So scope the investigation to the exposure, not to the whole tenant: analysis on 200 files costs a fraction of analysis on 200,000.

The purge cap changes the plan: removing 5,000 leaked copies is at least five purge queries, each reviewed and approved. The audit cap means a broad 90-day search needs to be split by date or by user. The 40-million and 1 TB ceilings are not a constraint for a 10-to-500-person firm; the audit and purge caps are.

A 45-person engineering firm on Business Premium with the Purview Suite add-on discovers that a project folder of about 200 files was shared with an anyone link for eleven days, and that the link was posted in a client's Teams channel.

1. Contain. Remove the link, set the site's sharing to existing guests only, and note the time. This happens before any investigation and is not a DSI feature.
2. Open the investigation. From the DLP or Defender incident if one fired, or create an investigation and add the 200 items by search.
3. Audit search. Add the unified audit log activity for the link: who opened, downloaded or synced which files, and from where. Expect fewer than 3,000 events, so one search covers it.
4. AI analysis. Run deep content analysis on the 200 items. The categorization returns, for instance, 140 engineering drawings with no personal data, 42 contracts, 11 spreadsheets carrying employee names with bank details, and 7 files with credentials in plain text.
5. Review and act. Rotate the credentials, request a purge of any copies that landed in other locations inside the tenant, and record which eleven files trigger a notification obligation and to whom.
6. Report. Export the findings into the post-incident report: timeline from the audit data, categories and counts from the analysis, actions taken, and the sharing policy change that prevents a repeat.

What it costs at list prices: the licenses were already in place at $22.00 for Business Premium and $10.00 for the Purview Suite for Business Premium per user per month, $1,440 per month for 45 users (Microsoft list price, October 2026 price list). The DSI meters for 200 files are a small storage figure for the days the investigation is open plus the compute hours of one analysis run, billed to the firm's Azure subscription at Microsoft's published rates. Microsoft 365 Post-Incident Investigation and Report runs steps 2 to 6 and writes the report for $1,950 per project, and what a post-incident report should contain shows the format.

What is Microsoft Purview Data Security Investigations?

A Purview solution for investigating a data incident: you collect the impacted items into an investigation, run AI analysis to categorize them and find sensitive content, see who touched them through audit activity, and purge items where needed. It opens from Defender XDR incidents, Insider Risk Management cases and Data Security Posture Management insights.

How much does Data Security Investigations cost?

There is no per-user license. It bills through an Azure subscription in your tenant on two meters, storage per GB per month and AI compute units per hour of analysis, at the rates Microsoft publishes on the Azure pricing page for Purview. Failed operations are not billed; partial and cancelled jobs are billed for the compute already used.

Do I need Microsoft 365 E5 for Data Security Investigations?

Microsoft's documentation says no dedicated enterprise plan or license is required; you need an Azure subscription configured for Purview pay-as-you-go and the Data Security Investigations role groups. The tools that usually trigger an investigation, such as Insider Risk Management and DLP, are licensed per user through E5, the E5 add-ons or the Purview Suite.

Is Data Security Investigations the same as eDiscovery?

No. eDiscovery preserves, collects, reviews and exports content for a legal matter under per-user licensing. Data Security Investigations analyzes the content of a security incident with AI to find what was sensitive and who had access, and bills pay-as-you-go. They often run in sequence on the same incident.

What data sources can Data Security Investigations use?

Defender XDR incidents, Insider Risk Management cases and DSPM insights open investigations with their items; audit search adds unified audit log activity; Endpoint DLP evidence is in preview as a source. Items are limited to 40 million documents and 1 TB per investigation.

Who can run a Data Security Investigation?

Members of the Data Security Investigations Admins, Investigators or Reviewers role groups, with the Security Administrator and Security Operator roles for investigations opened from the Defender portal and an Insider Risk Management role for those opened from an IRM case.

• Learn about Data Security Investigations — Microsoft Learn, checked 2026-10-11
• Billing in Data Security Investigations — Microsoft Learn, checked 2026-10-11
• Limits in Data Security Investigations — Microsoft Learn, checked 2026-10-11
• Assign permissions in Data Security Investigations — Microsoft Learn, checked 2026-10-11
• Create an investigation in Data Security Investigations — Microsoft Learn, checked 2026-10-11
• Learn about Microsoft Purview billing models — Microsoft Learn, checked 2026-10-11
• Microsoft Purview pricing — Microsoft Azure, checked 2026-10-11
• Microsoft Purview Data Security Investigations is now generally available — Microsoft Tech Community, checked 2026-10-11
• Microsoft Purview — Microsoft, checked 2026-10-11
• Microsoft NCE price list (US), October 2026: Microsoft Purview Suite, Microsoft Purview Suite for Microsoft 365 Business Premium, Microsoft 365 E5 Insider Risk Management, Microsoft 365 E5 eDiscovery and Audit, Microsoft 365 E5, Microsoft 365 Business Premium (Microsoft list price, October 2026 price list)