MC1385588 - Microsoft Purview | Data Loss Prevention - Enriched Audit Data for Matched Rules in Exchange Online

What and Why:

We are enhancing Microsoft Purview Data Loss Prevention (DLP) audit data for Exchange Online by adding enriched matched condition details whenever a DLP rule is triggered. Previously, audit records primarily surfaced sensitive information type (SIT) matches. With this update, audit records now include all contributing rule conditions, including non-SIT conditions such as sender and recipient attributes, attachment properties, subject keywords, and message metadata.

This change aligns with Microsoft’s enterprise-ready security and compliance commitments. It provides clearer insight into why a DLP rule was triggered without requiring manual cross-referencing of policy configurations and audit logs.

This message is associated with Roadmap ID 562051.

Rollout Schedule:

• General Availability (Worldwide): Rollout begins late June 2026 and is expected to complete by late July 2026.

Impact on Your Organization:

Who is affected:

• Administrators managing Microsoft Purview DLP policies scoped to Exchange Online
• Security and compliance teams reviewing DLP alerts, audit logs, or Activity Explorer data

Platforms/Services:

• Microsoft Purview
• Exchange Online
• Unified Audit Log
• Activity Explorer
• DLP Alerts and user notifications

What will happen:

• When a DLP rule in Exchange Online matches content, audit records will include enriched matched condition data for all contributing conditions.
• The enriched data includes the condition name, matched value, and the source that produced the match.
• This information appears in DLP Alerts, Activity Explorer, the Unified Audit Log, and user notifications where applicable.
• The feature is enabled by default.
• No configuration changes or policy updates are required.
• DLP enforcement behavior is unchanged.

Supported conditions and example output:

Attachment conditions

Condition	Example output
File extension is	Attachment Extension: txt — Testing.txt
Document or attachment is password protected	File.txt — Password Protected
Document could not be scanned	File.txt — Other Error
Document didn’t complete scanning	File.txt — Other Error
Attachment count over	12 — Document1.pdf; Document2.pdf; Document3.pdf; Document4.pdf; Document5.pdf; ...+7 more

Sender conditions

Condition	Example output
Shared by users	[email protected]
Sender domain is	contoso.com — [email protected]
Sender IP address is	192.168.1.100 — [email protected]
Sender AD attribute contains words	Sales Department — [email protected]

Recipient conditions

Condition	Example output
Recipient domain is	fabrikam.com — [email protected]
Shared with user	[email protected] — USERNAME
Unique domain count over	3 — contoso.com; fabrikam.com; adventureworks.net
Recipient AD attribute contains words	Seattle — [email protected]; Portland — [email protected]

Subject and body conditions

Condition	Example output
Subject contains words	Matchedword — Subject: this is Matchedword subject

Message conditions

Condition	Example output
Message size over	5242880 — Q1 Financial Report with Attachments

How matched condition evidence is structured:

• Condition name: The DLP rule condition evaluated (for example, “Sender domain is”).
• Matched value: The specific value that satisfied the condition (for example, “contoso.com”).
• Source: The originating item that produced the match (for example, “[email protected]”).

If multiple values match a condition, all contributing sources are listed. If more than five attachments match, the first five are shown followed by a count of additional matches (for example, “+7 more”).

Action Required / Recommendations:

No action is required. This feature is enabled automatically for all DLP policies scoped to Exchange Online.

• Optionally validate enriched data by triggering a DLP rule match.
• Review the matched event in Activity Explorer under Data Loss Prevention > Activity Explorer.
• Review DLP Alerts for the same enriched matched condition details.

Note: Matched condition details may take up to 60 minutes to appear in Activity Explorer.

Compliance considerations:

Area	Explanation
Audit logging capabilities	Audit records now include additional matched condition metadata for DLP rule evaluations in Exchange Online.
Admin monitoring and reporting	Admins gain increased visibility into DLP rule triggers via Activity Explorer, alerts, and audit logs.
Processing of existing customer data	Existing email metadata and DLP evaluation results are logged with richer detail; no new data types are introduced.