MC940076 - Purview | Data Loss Prevention: Fetch the original file resulting in a DLP policy match as evidence

Data Loss Prevention (DLP) investigators have the option to preview and download the full file that resulted in a DLP policy match as evidence on Windows devices using Microsoft Managed storage.

This message is associated with Microsoft 365 Roadmap ID 420333.

When this will happen:

Public Preview: We will begin rolling out mid-November 2024 and expect to complete by early December 2024.

General Availability (Worldwide) We will begin rolling out late January 2025 and expect to complete by late February 2025.

How this will affect your organization:

There is no impact on your organization if you choose not to use this feature.

If your organization requires you to keep a copy of the original file that matches a DLP rule, you will be able to preview and download the original file for further workflow from Activity explorer and DLP Alert tabs. Currently this feature will only be supported for endpoint Windows devices.

What you need to do to prepare:

In endpoint DLP settings, enable evidence collection and select Microsoft Managed storage, followed by creating a policy for endpoint and selecting the activities you wish to collect from the original file as evidence.

For more details about this feature refer to the following links:

Learn about collecting files that match DLP policies from devices (preview) | Microsoft Learn

Get started with collecting files that match data loss prevention policies from devices (preview) | Microsoft Learn