RM497838 - Microsoft Purview compliance portal: Endpoint Data Loss Prevention - Ability to fetch the original file resulting in policy match as evidence (Microsoft Managed storage)

With this capability, Admins can choose to store a copy of the file that resulted in a DLP policy match. The admin uses this data to analyze the contents to confirm the full set of data that was exfiltrated to assess severity. To configure Microsoft managed storage, similar to customer managed storage, the user can go to endpoint DLP settings and select Microsoft managed storage. As compared to customer managed storage - the admin need not configure any additional settings like adding a blob, assigning permissions, selecting storage in policy workflow.

GA date: August CY2025