Excavate with
Microsoft Purview.
Purview gives your team the tools to detect, investigate and act on insider risk, with built-in detections focused on Microsoft services. Excavate keeps the record across the systems you run and does the investigating. Many companies on E5 will want both.
Last checked 14 October 2026 · Sources below
Purview Insider Risk Management is software in your Microsoft 365 tenant: policies evaluate a person after a triggering event, raise alerts, and your analysts investigate. Excavate is a service: we keep a record across Microsoft 365 and your other systems, work every trigger, and hand back written conclusions. Keep Purview for prevention, and let Excavate do the investigating.
What Excavate adds
to Purview.
The work Purview leaves to your team, done for you.
For decisions about an employee, Microsoft’s setup guide asks customers to “conduct their own full investigation” “and not just rely on insights from the Insider Risk Management service.”1 Our examiners do that work with your team, and only an examiner can conclude anything against a person.
Detections run on everyone’s record, including backfilled history. In Purview, a policy evaluates a person after a triggering event, and anyone else needs an investigator to pull a user activity report.23
Slack, GitHub, Google Workspace, HR systems and company AI accounts, through read-only APIs. In Purview, other systems come in as extra indicators, alerts or imported aggregates.41
Purview deletes alerts that never became a case, and resolved cases, after 120 days. Active cases never expire.5 Excavate keeps the record until you delete it.
An exit review for every departure, opened from your HR system. We ask IT to hold the laptop until it closes. Purview flags departing-user activity for your analysts to review.2
Every case ends in a written conclusion signed by the examiner, with the evidence and its chain of custody, ready for counsel or HR.
Side by side.
| Purview with Excavate | Purview on its own | |
|---|---|---|
| Who investigates | Our AI agent and examiners. Only an examiner escalates or concludes against a person. | Your analysts, with an AI agent that sorts alerts.6 |
| What you hold at the end | A written conclusion, signed by the examiner. | Alerts and cases. A case can go to eDiscovery.7 |
| When a person is looked at | Detections run on everyone’s record, including backfilled history. | After a triggering event, looking back up to 90 days, or 10 for email. Investigators can also pull a 90-day report on anyone.83 |
| How long alerts and cases last | Nothing expires until you delete it. | Active cases never expire. Alerts outside a case, and resolved cases, last 120 days.5 |
| Departing employees | An exit review for every departure, opened from your HR system during offboarding. | A template triggered by HR dates or Entra account deletion.2 |
| Systems outside Microsoft | Read directly, through read-only APIs. | Extra indicators, alerts or imported aggregates.41 |
| Blocking data leaving | Still Purview: DLP and Adaptive Protection keep doing it. | DLP blocking for high-risk users, through Adaptive Protection.9 |
How Purview works.
From Microsoft’s own public documentation, as of 14 October 2026.
Policies come from Microsoft’s templates, such as Data theft by departing users. A policy evaluates a person after a triggering event, such as a resignation date or the deletion of their Entra account, or once an admin adds them by hand. It then looks back up to 90 days, or 10 days for email.28 Investigators can also create a user activity report on anyone, covering a 90-day period, with no trigger needed.3
The departing-user template runs on a resignation or termination date, or when the person’s Entra account is deleted. Dates come through Microsoft’s HR connector.212 A quick policy also covers data theft from non-Microsoft 365 cloud apps by people who are leaving.13
Your own analysts and investigators work the alerts and cases, with names pseudonymized by default.14 Microsoft’s setup guide states: “customers acknowledge that they must conduct their own full investigation related to the individual user’s behavior, character, or performance materially related to employment, and not just rely on insights from the Insider Risk Management service.”1
A Security Copilot agent sorts alerts from the policies you select into Needs attention and Less urgent.15 Microsoft notes that “The agent doesn’t triage all alerts.”6
Alerts that never became a case, and resolved cases, are deleted after 120 days. Active cases never expire.5
Built-in detections focus on Microsoft services.1 Other cloud apps, network traffic and AI apps can be added as extra indicators, and other systems arrive as alerts or imported aggregates.41
Adaptive Protection uses each person’s risk level to apply DLP blocking for high-risk users.9
What stays in Purview.
Keep DLP and Adaptive Protection for blocking, and eDiscovery for the cases you escalate. Excavate reads Microsoft 365 and Entra ID through read-only APIs, so it changes none of Purview’s policies. It adds the record across your other systems, an exit review for every departure, and the investigating, ending in a written conclusion.
Questions buyers ask.
We already have E5. Why add Excavate?+
E5 gives your team the tools. It does not give them the hours. Purview raises alerts for your analysts to work. Excavate does the investigating, reads the systems outside Microsoft 365 directly, reviews every departure, and ends in a written conclusion you can hand to counsel or HR.
Does Excavate replace Purview?+
No, and it does not need to. Keep Purview for blocking, and let Excavate do the investigating.
Does Excavate read Microsoft 365?+
Yes, through read-only APIs, along with Entra ID. You grant one read-only consent per source, and nothing changes in your tenant’s policies.
We don’t have E5. Do we need Purview first?+
No. Excavate does not need Purview Insider Risk Management: it reads Microsoft 365 through read-only APIs, and your other systems the same way.
What about Microsoft’s AI triage agent?+
It sorts alerts from the policies you select into Needs attention and Less urgent, for your analysts, and Microsoft notes it doesn’t triage all alerts. At Excavate our AI agent and examiners work every trigger together, and only an examiner can escalate a review or conclude anything against a person.
What does our team still do?+
Grant read-only access, ask IT to hold a leaver’s laptop, run our collection tool when a case needs it, and decide what to do with each conclusion.
- Microsoft Learn: Get started with insider risk management
- Microsoft Learn: Insider risk management policy templates
- Microsoft Learn: Use reports in insider risk management
- Microsoft Learn: Policy indicators
- Microsoft Learn: Insider risk management limits
- Microsoft Learn: Agents in Microsoft Purview
- Microsoft Learn: Insider risk management cases
- Microsoft Learn: Policy timeframes
- Microsoft Learn: Adaptive Protection
- Microsoft Learn: Microsoft Purview service description
- Microsoft: Microsoft Purview Suite
- Microsoft Learn: Set up a connector to import HR data
- Microsoft Learn: Insider risk management policies
- Microsoft Learn: Learn about insider risk management
- Microsoft Learn: Insider risk management activities
- Microsoft Learn: Browser signal detection (page updated 18 Nov 2025)
Microsoft, Microsoft 365, Microsoft Purview and Entra are trademarks of the Microsoft group of companies. Excavate is not affiliated with or endorsed by any company named on this page. If something here is out of date, write to info@excavate.ai and we will correct it.
See it on your own systems.
Thirty minutes on the systems you run, and what Excavate would do with them.
All comparisons →