Microsoft Purview compliance portal: Endpoint Data Loss Prevention – Ability to fetch the original file resulting in policy match as evidence (customer managed storage)

Microsoft Purview compliance portal now offers a new feature that allows admin to access a copy of the original file that triggered the DLP policy match. This feature is crucial in analyzing the content to confirm the full set of sensitive data that was exfiltrated and assessing severity in alerts triage and incident management. The original file is uploaded to a customer managed storage (Azure blob) and can be accessed for further actions. This new feature is available in General Availability release phase, with a release date set for November CY2024. The platform is available on web cloud instance for DoD and GCC High and roadmap ID is 429871.

To sum up, Microsoft Purview compliance portal delivers endpoint data loss prevention with the ability to fetch the original file that matches the policy, serving as evidence stored in customer managed storage for further incident handling.

The post Microsoft Purview compliance portal: Endpoint Data Loss Prevention – Ability to fetch the original file resulting in policy match as evidence (customer managed storage) originally appeared on M365 Admin.