What and why
Microsoft Purview Data Loss Prevention (DLP) is introducing a new Exchange Online condition: Count of labeled documents is greater than. This condition enables administrators to detect messages that contain a high volume of sensitivity-labeled attachments and trigger DLP actions when a configured threshold is exceeded.
The condition is available for Exchange Online DLP policies and does not apply to SharePoint, OneDrive, Teams, or Endpoint DLP workloads.
This enhancement helps organizations strengthen data protection by identifying potential data exfiltration scenarios where multiple sensitivity-labeled files are shared in a single email. The feature provides an additional volume-based signal that can be combined with existing content-based DLP conditions for layered protection.
Rollout schedule
- Public Preview: Beginning in early November 2026 and expected to complete by early December 2026
- General Availability (Worldwide): Beginning in mid-December 2026 and expected to complete by late December 2026
Impact on your organization
Who is affected
- Administrators who manage Exchange Online DLP policies
Platforms and services
- Microsoft Purview Data Loss Prevention
- Exchange Online
- Microsoft Purview compliance portal
What will happen
- Administrators will be able to create DLP rules that evaluate the number of sensitivity-labeled attachments included in a single email message.
- Each attachment with a matching sensitivity label will be counted individually, including duplicate copies of the same file.
- When multiple sensitivity labels are selected in a rule, the condition evaluates the combined count of all matching attachments.
- The condition uses a strict greater-than threshold. For example, a threshold of 3 is triggered when 4 or more matching attachments are detected.
- Administrators can combine this condition with existing DLP conditions and actions for layered protection.
- The feature is administrator configured and is not enabled automatically through existing policies.
- Encrypted (rights-protected) attachments: protection wrapper is excluded to prevent double-counting.
Action required and recommendations
No action is required before rollout.
We recommend that administrators:
- Review existing Exchange Online DLP policies to determine whether attachment count thresholds would improve protection for sensitive content.
- Evaluate appropriate thresholds and policy actions based on organizational risk requirements.
- Test policies in simulation or audit mode before enabling enforcement actions.
- Update internal DLP administration documentation if supported Exchange Online conditions are documented within your organization.
Learn more
Compliance considerations
| Question | Answer |
| Does the change modify, interrupt, or disable Data Loss Prevention (DLP) policies or enforcement? | Yes. The update adds a new Exchange Online DLP condition that administrators can choose to use when creating or modifying DLP policies. |
| Does the change alter how admins can monitor, report on, or demonstrate compliance activities? | Yes. Administrators gain an additional policy condition that can be used to identify and respond to high-volume sharing of sensitivity-labeled content. |
| Does the change include an admin control and, can it be controlled through Entra ID group membership? | Yes. Administrators can configure the condition through Microsoft Purview DLP policies. The available information does not indicate that the condition itself can be controlled through Entra ID group membership. |