Microsoft Purview compliance portal: Data Loss Prevention for endpoints – Ability to fetch the original file resulting in a DLP policy match as evidence (Microsoft managed storage)

Originally posted by Microsoft Jan 11, 2024 Uncategorized 0 Comments

With this capability, Admins can choose to store a copy of the file that resulted in a DLP policy match. The admin uses this data to analyze the contents to confirm the full set of data that was exfiltrated to assess severity.

To configure Microsoft managed storage, similar to customer managed storage, the user can go to endpoint DLP settings and select Microsoft managed storage. As compared to customer managed storage, the admin need not configure any additional settings like adding a blob, assigning permissions, or selecting storage in policy workflow.