Microsoft Purview compliance portal: Endpoint Data Loss Prevention - Ability to fetch the original file resulting in policy match as evidence (customer managed storage)

In the alerts triage and incident management experience, the admin can access a copy of the file that was restricted by DLP. The original file is uploaded to a customer managed storage (Azure blob). The admin uses this data to analyze the contents to confirm the full set of data that was exfiltrated to assess severity.