Purview | Data Loss Prevention: Fetch the original file resulting in a DLP policy match as evidence

This post discusses data loss prevention (DLP) policies and how DLP investigators can use Microsoft Managed storage to obtain the original file that matched a DLP policy, providing evidence for further investigation. The post contains information on the rollout plan for this feature and explains how to prepare for it by enabling evidence collection and creating an appropriate policy. This feature is currently only available for Windows devices and is not mandatory for use. The post is associated with Microsoft 365 Roadmap ID 420333 and has a message ID of MC940076.

Overall, this post provides useful information for organizations that use DLP policies to safeguard their data. By utilizing this feature, investigators can gather more evidence and gain a better understanding of DLP policy matches, leading to more effective investigations.

The post Purview | Data Loss Prevention: Fetch the original file resulting in a DLP policy match as evidence originally appeared on M365 Admin.