Microsoft Purview | Data Loss Prevention: Count of labeled documents condition for Exchange Online

Microsoft Purview DLP introduces a new Exchange Online condition to detect emails with a high count of sensitivity-labeled attachments, enhancing data protection. Available from November 2026, it allows admins to set thresholds for labeled files in emails, combining volume and content signals for better DLP policy enforcement. Microsoft Purview Data Loss Prevention (DLP) is introducing a new Exchange Online condition: Count of labeled documents is greater than. This condition enables administrators to detect messages that contain a high volume of sensitivity-labeled attachments and trigger DLP actions when a configured threshold is exceeded.  The condition is available for Exchange Online DLP policies and does not apply to SharePoint, OneDrive, Teams, or Endpoint DLP workloads. This enhancement helps organizations strengthen data protection by identifying potential data exfiltration scenarios where multiple sensitivity-labeled files are shared in a single email. The feature provides an additional volume-based signal that can be combined with existing content-based DLP conditions for layered protection. Rollout schedule Public Preview: Beginning in early November 2026 and expected to complete by early December 2026 General Availability (Worldwide): Beginning in mid-December 2026 and expected to complete by late December 2026 Impact on your organization Who is affected Administrators who manage Exchange Online DLP policies Platforms and services Microsoft Purview Data Loss Prevention Exchange Online Microsoft Purview compliance portal What will happen Administrators will be able to create DLP rules that evaluate the number of sensitivity-labeled attachments included in a single email message. Each attachment with a matching sensitivity label will be counted individually, including duplicate copies of the same file. When multiple sensitivity labels are selected in a rule, the condition evaluates the combined count of all matching attachments. The condition uses a strict greater-than threshold. For example, a threshold of 3 is triggered when 4 or more matching attachments are detected. Administrators can combine this condition with existing DLP conditions and actions for layered protection. The feature is administrator configured and is not enabled automatically through existing policies. Encrypted (rights-protected) attachments: protection wrapper is excluded to prevent double-counting. Action required and recommendations No action is required before rollout. We recommend that administrators: […]

The post Microsoft Purview | Data Loss Prevention: Count of labeled documents condition for Exchange Online appeared first on M365 Admin.