Microsoft Security May 2026: Purview and Entra Updates

Introduction

Microsoft Security’s May 2026 updates are aimed at a growing challenge for IT and security teams: protecting data, identities, and AI agents across increasingly complex environments. As organizations adopt more AI services and third-party tools, Microsoft is adding stronger posture management, deeper investigations, and more secure identity recovery options.

What’s new in Microsoft Security

Microsoft Purview DSPM is now generally available

The new Microsoft Purview Data Security Posture Management (DSPM) experience is now generally available. Microsoft says the updated experience brings discovery, protection, investigation, and remediation into a more unified workflow.

Key improvements include:

• Goal-oriented workflows for faster risk assessment
• Expanded reporting and deeper remediation options
• Better visibility across third-party environments
• Streamlined investigation and action from a single experience

For administrators, this should make it easier to identify sensitive data exposure and respond at scale without jumping between multiple tools.

Purview Data Security Investigations adds OCR and custom examinations

Microsoft also expanded Purview Data Security Investigations with:

• Optical character recognition (OCR) to extract text from images
• Custom examinations for tailored investigation scenarios

This matters because sensitive information is not always stored in searchable text documents. With OCR, investigators can now bring image-based content into AI-powered analysis. Custom examinations also give security teams more flexibility to detect organization-specific risks beyond Microsoft’s built-in checks.

Entra ID Account recovery adds secure access restoration

Microsoft Entra ID Account recovery is designed to help users regain access when they have lost all registered authentication methods. Unlike standard password reset workflows, this feature focuses on re-establishing trust and verifying identity before authentication methods are replaced.

This is especially important for organizations strengthening phishing-resistant authentication and reducing help desk friction in account recovery scenarios.

Windows 365 for Agents expands in public preview

Windows 365 for Agents is expanding in public preview and works alongside Microsoft Agent 365 to provide a secure environment for AI agent execution.

According to Microsoft:

• Agent 365 governs what an agent is authorized to do
• Windows 365 for Agents provides the managed execution environment
• Agents can run in auditable, policy-controlled Cloud PCs

This is a notable step for organizations exploring enterprise AI agents while maintaining governance and security controls.

Impact on IT administrators

Security and identity teams should view these updates as part of Microsoft’s broader push toward protecting AI, data, and identities together. The biggest practical benefits are improved data risk workflows in Purview, stronger investigation capabilities, and a more secure path for account recovery.

Next steps

• Review the new Purview DSPM experience if your organization uses Microsoft Purview
• Evaluate OCR and custom examinations for data investigation use cases
• Assess Entra ID Account recovery for identity resilience planning
• Monitor Windows 365 for Agents if you are testing or deploying AI agents in the enterprise