Updated January 27, 2025: We have updated the content. Thank you for your patience.
Data Loss Prevention (DLP) investigators have the option to preview and download the full file that resulted in a DLP policy match as evidence on Windows devices using Microsoft Managed storage.
This message is associated with Microsoft 365 Roadmap ID 420333.
When this will happen:
Public Preview: We will begin rolling out mid-November 2024 and expect to complete by early December 2024.
General Availability (Worldwide) We will begin rolling out late January 2025 and expect to complete by late February 2025.
How this will affect your organization:
There is no impact on your organization if you choose not to use this feature.
If your organization requires you to keep a copy of the original file that matches a DLP rule, you will be able to preview and download the original file for further workflow from Activity explorer and DLP Alert tabs. Currently this feature will only be supported for endpoint Windows devices.
What you need to do to prepare:
In endpoint DLP settings, enable evidence collection and select Microsoft Managed storage, followed by creating a policy for endpoint and selecting the activities you wish to collect from the original file as evidence.
View usage of Microsoft Managed Storage
You can view and export the daily usage for the past 6 months for Microsoft Managed storage.
1. Sign in to the https://purview.microsoft.com and open Settings from the left panel
2. Choose Data Loss Prevention
3. Select Endpoint DLP settings
4. Expand Setup evidence collection for file activities on devices
5. Click on View Usage button, a panel will open. Here you can see the month wise graph of daily usage and also export the usage data.
For more details about this feature refer to the following links:
Learn about collecting files that match DLP policies from devices (preview) | Microsoft Learn