Purview | Data Loss Prevention: Fetch the original file resulting in a DLP policy match as evidence

Originally posted by Microsoft Nov 25, 2024 Uncategorized 0 Comments

Data Loss Prevention (DLP) investigators have the option to preview and download the full file that resulted in a DLP policy match as evidence on Windows devices using Microsoft Managed storage.

This message is associated with Microsoft 365 Roadmap ID 420333.

When this will happen:

Public Preview: We will begin rolling out mid-November 2024 and expect to complete by early December 2024.

General Availability (Worldwide) We will begin rolling out late January 2025 and expect to complete by late February 2025.

How this will affect your organization:

There is no impact on your organization if you choose not to use this feature.

If your organization requires you to keep a copy of the original file that matches a DLP rule, you will be able to preview and download the original file for further workflow from Activity explorer and DLP Alert tabs. Currently this feature will only be supported for endpoint Windows devices.

View image in new tab

What you need to do to prepare:

In endpoint DLP settings, enable evidence collection and select Microsoft Managed storage, followed by creating a policy for endpoint and selecting the activities you wish to collect from the original file as evidence.

For more details about this feature refer to the following links:

View image in new tab