Investigation settings in Data Security Investigations (preview)

Investigation details allow you to view and update investigation information and to take action on specific investigations.

Investigation details

The following information is displayed for the selected investigation:

• ID: Displays the investigation identification number. This ID can be reviewed, but can't be changed once the investigation is created.
• Investigation name: Displays the investigation name. This field is required. To change the investigation name, enter the new investigation name and select Actions > Save.
• Investigation description: Displays an optional description to help others understand this investigation. To change the investigation description, enter the new investigation description and select Actions > Save.
• Investigation status: Displays the current investigation status.
• Investigation created: Displays the date and time when the investigation was created.

Delete an investigation

You can delete investigations when they're no longer needed for your organization. When you delete an investigation, all components associated with the investigation, such as searches, investigation scopes, and mitigation plans are deleted. You can't recover a deleted investigation.

To delete an investigation, complete the following steps:

1. Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned Data Security Investigations permissions.
2. Select the Data Security Investigations (preview) solution card and then select Investigations in the left navigation pane.
3. Select an investigation, the select Investigation settings.
4. On the Investigation settings page, select Actions, and then select Delete investigations.