Microsoft Purview: Data Loss Prevention - Enriched Audit Data for Matched Rules

When DLP rules detect policy violations in Exchange Online, they generate audit records that administrators rely on for compliance monitoring, incident investigation, and policy tuning. Previously, these records only showed Sensitive Information Type matches. This feature aims to extend that to sender domain, subject keywords, attachment type, or recipient information. Now they will be visible in alerts and Activity Explorer providing data enrichment to the administrators.

Affected: Microsoft Purview

Related changes

• Microsoft Purview compliance portal: Data Loss Prevention - Decoupling of Policy tips and Email notifications while configuring rules on Data Loss Prevention for Sharepoint and Onedrive · Data
• Microsoft Purview: Data Loss Prevention - Data Loss Prevention to safeguard sensitive information from external web search in Microsoft 356 Copilot and Copilot Chat · Data
• Microsoft Purview: Data Security Triage Agent in Data Loss Prevention - Reasoning Trace and Confidence Score for agent-triaged alerts · Data
• Microsoft Purview compliance portal: Data Loss Prevention - DLP Policy Tip Support in Outlook for Mac · Data
• Microsoft Purview: Data Loss Prevention - Data Security Triage Agent summaries and categorizations for DLP alerts will be made available in DLP Alerts in Microsoft Defender XDR · Data
• Microsoft Purview: Data Loss Prevention – File Quarantine Action in DLP for SharePoint/OneDrive · Data

View at Microsoft → Copy summary