Investigate a breached mailbox with DSI
Data Security Investigations in Microsoft Purview. DSI uses AI to read the content of the data in an investigation. Setup has three tasks: pay-as-you-go billing through an Azure subscription, AI capacity with a processing location, and roles. We create an investigation from the Investigate a breached mailbox template for Eli, let DSI add 2,732 items to scope, categorize them with AI and examine the items that matter. The result is AI-generated and must be checked.
W
INVESTIGATION AND RESPONSE
Investigate a breached mailbox with DSI
Ada Admin
Eli Employee
DATA SECURITY INVESTIGATIONS
The audit log shows actions, DSI reads content
The attacker had Eli's mailbox for hours. What did it contain?
Thousands of emails are too many to read by hand.
DSI brings the data into an investigation and lets AI sort, search
and examine it.
Pay-as-you-go, through an Azure subscription
You pay for the data you bring in, and for the AI work you run on it.
Microsoft Purview
Data Security Investigations
Identify incident-related data, investigate that data with generative AI-powered deep content analysis, and mitigate risk.
Setup tasks
Investigate faster with a search template
Investigations
Create investigations to use AI to identify and analyze your data, and get comprehensive mitigation plans.
+ Create investigation
Delete
↻ Refresh
0 items
Title
Description
Created on
Last modified by
Start by creating an investigation and bring your data over.
Investigations › Eli Employee - Breached mailbox investigation
Eli Employee - Breached mailbox investigation
Summary
Analysis
Mitigation
Activities
Adding items to scope
Items are now being added to your investigation scope. This may take some time.
Investigations › Eli Employee - Breached mailbox investigation
Eli Employee - Breached mailbox investigation
Summary
Analysis
Mitigation
Activities
Categorization is in progress...
Examination results
0
Categories
✚
Categorize with AI
There are no active categorizations.
Categorize
Intellectual Property (45)
Incident and Investigation (12)
✦ Describe what you are looking for
Explore insights
Categorize
Examine
2732 items
Subject/Title
Category
Sender/Author
Date (UTC)
← Back
Examination results
Threats and mitigation
Type: Mitigation
Scope: 57 items
Date: Oct 18, 2026
Status: Successful
Threats and mitigation
Examination type: Identify threats and recommend mitigation steps in selected evidence
Scope: 57 items Status: Successful
Subject/Title
Risk score
Risk summary
Mitigation steps
ⓘ AI-generated content may be incorrect. Check it for accuracy.
Link an Azure subscription for pay-as-you-go billing
The subscription you select will be used to manage all pay-as-you-go capabilities in Microsoft Purview.
Your org will only pay for the features used, no upfront costs, no commitment.
Country/region *
Azure subscription *
Resource group *
ⓘ The resource will be created under the selected resource group, and pay-as-you-go
feature usage will be billed to the selected Azure subscription.
I acknowledge that I have read, understood, and agree to the Terms and Conditions
Enable
Cancel
Set up AI capacity
DSI compute units are available on demand for running AI
analysis features.
AI analysis data processing location *
⌄
If this location is busy, allow the AI to process data
anywhere in the world. You can change this later.
I acknowledge that I have read, understood, and agreed
to the Terms and Conditions
Confirm
Data Security Investigations (DSI) is
now ready to use.
Go to DSI
Select a search template
or
+
Customize your own
Build your own investigation by scoping your org's data.
New investigation - Breached mailbox investigation
Name *
People *
EE
Eli Employee ×
Search by name or email
What we filled in for you
Additional context for AI
Compromised account sensitive data exposure review.
Date range
9/18/2026 - 10/18/2026 (Past 30 days)
Back
Customize
Start investigating
Categorize items
Categorize items using AI to organize your data and identify risks.
Select categorization mode
Standard
AI groups your scope into the selected categories.
Advanced
Also organizes each category into topics. Takes additional time and resources.
Choose categories (0/50)
Default categories
0/13 Selected
Health Information
Incident and Investigation Information
Intellectual Property
Marketing Information
Operational Information
Start
Cancel
Examine
Use AI to run a deep content analysis of your data to identify risks
and sensitive data.
Investigation context
Compromised account sensitive data exposure review.
Selected items
57 items (8.4 MB)
Name
Examination type *
Select examination type
Credentials: Extract the credentials and access assets
Risk: Analyze and score all active risks
Mitigation: Identify threats and recommend mitigation steps
Personal Data: Identify and extract personal data
+ Add custom examination
Examine
Good to know
1/7
INVESTIGATION AND RESPONSE
Investigate a breached mailbox with DSI
Eli's mailbox was breached. We set up Data Security
Investigations, create an investigation from a
template, and let AI categorize and examine what
the attacker could have seen.
informasjonsbeskyttelse.no
Previous
Next
Play
Restart
Fullscreen
Sound: off