Microsoft Purview: Data Loss Prevention-Alert Classification Property for DLP Alerts on Purview Portal

This feature introduces the ability to classify DLP alerts directly in the Purview portal. In addition to assigning a status, customers can now categorize alerts as True Positive, False Positive, or Benign Positive. This capability helps security teams better organize, track, and manage alerts, enabling more accurate reporting and efficient incident handling.

Affected: Microsoft Purview

Related changes

• Microsoft Purview: Data Security Triage Agent in Data Loss Prevention - Reasoning Trace and Confidence Score for agent-triaged alerts · Data
• Microsoft Purview compliance portal: Data Loss Prevention - DLP Policy Tip Support in Outlook for Mac · Data
• Microsoft Purview: Data Loss Prevention - Data Security Triage Agent summaries and categorizations for DLP alerts will be made available in DLP Alerts in Microsoft Defender XDR · Data
• Microsoft Purview compliance portal: Data Loss Prevention - Decoupling of Policy tips and Email notifications while configuring rules on Data Loss Prevention for Sharepoint and Onedrive · Data
• Microsoft Purview compliance portal: Data Loss Prevention - Actionable Email Notifications for Enhanced Incident Remediation · Data
• Microsoft Purview: Data Loss Prevention - Granular classification error controls (Exchange online) · Data

View at Microsoft → Copy summary