Microsoft Purview | Data Loss Prevention – Enrich Defender alerts Graph API with DLP event data

Microsoft Purview DLP event details will be integrated into Microsoft Graph Security APIs alongside Defender alerts, simplifying correlation, reporting, and SIEM integration. Public preview starts late May 2026; general availability begins late June 2026. This affects admins using these APIs for DLP-related alert data. To help security and compliance teams more easily correlate Microsoft Purview Data Loss Prevention (DLP) activity with Microsoft Defender alerts, we’re enriching Microsoft Graph security APIs so DLP event (rule match) details can be retrieved alongside Defender alert data. This simplifies exporting data to SIEM tools, building automated workflows, and generating custom reports without needing to stitch together data from multiple APIs. This message is associated with Microsoft 365 Roadmap ID 558681. When this will happen: Public Preview: Rollout begins in late May 2026 and is expected to complete early June 2026. General Availability (Worldwide): Rollout begins in late June 2026 and is expected to complete early July 2026. How this affects your organization: Who is affected: Admins, security engineers, and developers who use Microsoft Graph Security APIs to retrieve Defender alerts and/or Purview DLP event data for reporting, investigations, SIEM integration, or automation. This applies only to DLP-related Defender alerts (the DLP events query will not return results for non-DLP alerts). What will happen: Before this update: Alert data is available through Microsoft Graph Security APIs, while DLP rule match event details are available through the Management API. Customers who need to correlate alerts with underlying DLP activity must retrieve data from multiple APIs and manually join the results. With this update: Microsoft Graph will include DLP event data associated with Defender alerts. This enables simplified correlation and integration without relying on multiple APIs. There is no impact to user experience. The following table shows the combined data available through this enhancement: Common Alert Data (Already present in Graph API) Common Event Data (Present in all events) Alert ID Event ID Incident ID User ID Status Workload Severity Event time Classification Operation Assigned to Policy details (ID, name, rule, action) Creation time Sensitive info types (ID, counts, confidence, values) Last update time Trainable classifier Resolve date […]

The post Microsoft Purview | Data Loss Prevention – Enrich Defender alerts Graph API with DLP event data appeared first on M365 Admin.