(Updated) Microsoft Purview: Data Security Investigations – analyze files tied to endpoint DLP alerts

Message ID

MC1258000

Service

Microsoft Purview

Summary

Microsoft Purview’s Data Security Investigations now includes endpoint Data Loss Prevention (DLP) events as a queryable source, enabling admins to analyze files linked to DLP alerts using AI tools. Rollout occurs June–July 2026, with no user impact or required admin action. This enhances investigation efficiency and compliance monitoring.

Details

Updated June 18, 2026: We have updated the timeline. Thank you for your patience.

[Introduction]

We’re introducing endpoint Data Loss Prevention (DLP) events as a queryable data source in Data Security Investigations (DSI) in Microsoft Purview. With this update, administrators can build endpoint DLP queries directly in DSI using filters such as date range, and DSI will automatically pull files associated with those events into the investigation for analysis. This integration helps security teams examine endpoint DLP activity at scale, reducing time and effort spent triaging individual alerts and improving the ability to identify patterns and potential data exfiltration scenarios.

This message is associated with Microsoft 365 Roadmap ID 558547.

[When this will happen]

Public Preview: Rollout begins in early June 2026 (previously late April) and completes in late June 2026 (previously early June).
General Availability (Worldwide): Rollout begins in late July 2026 (previously mid-June) and completes in late July 2026 (previously mid-June).

[How this will affect your organization]

Who is affected

Admins and security investigators using Data Security Investigations (DSI) and endpoint Data Loss Prevention (DLP) in the Microsoft Purview compliance portal.

What will happen

A new Endpoint DLP tab will appear in the DSI search experience, alongside the existing Query Builder and Audit tabs.
Admins and investigators can query endpoint DLP events using date range filters (additional filters coming soon).
Files associated with matching endpoint DLP events will be automatically added to the investigation scope for analysis using DSI’s AI‑powered tools.
This feature will appear automatically for eligible tenants when rollout completes. No admin action is required to enable it.
There is no user impact.

[What you can do to prepare]

No action is required. Optionally, you may:

Review how endpoint DLP query capabilities work within DSI.
Update internal documentation for alert triage and investigation workflows, if applicable.
Inform security teams and endpoint DLP administrators about this new capability.

Learn more:

[Compliance considerations]

Question	Answer
Does the change alter how existing customer data is processed, stored, or accessed?	Yes. Endpoint DLP event data becomes queryable in DSI, and associated files are automatically collected into investigations for analysis.
Does the change introduce or significantly modify AI/ML capabilities that interact with customer data?	Yes. DSI’s existing AI‑assisted investigation tools will now analyze files gathered through endpoint DLP queries.
Does the change modify how admins can monitor, report on, or demonstrate compliance activities?	Yes. Admins gain new ways to surface, query, and analyze endpoint DLP signals within DSI.

Change History

Show

Published: March 21, 2026

Last Updated: June 18, 2026

June 19, 2026 at 12:30 AM Updated

Summary

Microsoft Purview’s Data Security Investigations now includes endpoint Data Loss Prevention (DLP) events as a queryable source, enabling admins to analyze related files automatically. This update, rolling out June 2026, enhances investigation efficiency with AI tools and requires no user action.

New

Last Updated Date

2026-06-15T23:06:26.517Z

New

2026-06-18T22:06:55.913Z

Body Content

Updated June 15, 2026: We have updated the timeline. Thank you for your patience. [Introduction]We’re introducing endpoint Data Loss Prevention (DLP) events as a queryable data source in Data Security Investigations (DSI) in Microsoft Purview. With this update, administrators can build endpoint DLP queries directly in DSI using filters such as date range, and DSI will automatically pull files associated with those events into the investigation for analysis. This integration helps security teams examine endpoint DLP activity at scale, reducing time and effort spent triaging individual alerts and improving the ability to identify patterns and potential data exfiltration scenarios.This message is associated with Microsoft 365 Roadmap ID <a href="https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=558547" target="_blank">558547</a>.[When this will happen]<ul><li>Public Preview: Rollout begins in early June 2026 (previously late April) and completes in early June 2026 (previously mid‑May).</li><li>General Availability (Worldwide): Rollout begins in mid-June 2026 (previously mid‑May) and completes in mid-June 2026 (previously mid‑May).</li></ul>[How this will affect your organization]Who is affectedAdmins and security investigators using Data Security Investigations (DSI) and endpoint Data Loss Prevention (DLP) in the Microsoft Purview compliance portal.What will happen<ul><li>A new Endpoint DLP tab will appear in the DSI search experience, alongside the existing Query Builder and Audit tabs. </li><li>Admins and investigators can query endpoint DLP events using date range filters (additional filters coming soon). </li><li>Files associated with matching endpoint DLP events will be automatically added to the investigation scope for analysis using DSI’s AI‑powered tools. </li><li>This feature will appear automatically for eligible tenants when rollout completes. No admin action is required to enable it.</li><li>There is no user impact.</li></ul>[What you can do to prepare]No action is required. Optionally, you may:<ul><li>Review how endpoint DLP query capabilities work within DSI.</li><li>Update internal documentation for alert triage and investigation workflows, if applicable.</li><li>Inform security teams and endpoint DLP administrators about this new capability.</li></ul>Learn more: <ul><li><a href="https://learn.microsoft.com/purview/data-security-investigations" target="_blank">Learn about Data Security Investigations | Microsoft Purview | Microsoft Learn</a> </li><li><a href="https://learn.microsoft.com/purview/endpoint-dlp-learn-about" target="_blank">Learn about Endpoint data loss prevention | Microsoft Purview | Microsoft Learn</a></li></ul>[Compliance considerations]<table class="table table-bordered"><tbody><tr><td>Question</td><td>Answer</td></tr><tr><td>Does the change alter how existing customer data is processed, stored, or accessed?</td><td>Yes. Endpoint DLP event data becomes queryable in DSI, and associated files are automatically collected into investigations for analysis.</td></tr><tr><td>Does the change introduce or significantly modify AI/ML capabilities that interact with customer data?</td><td>Yes. DSI’s existing AI‑assisted investigation tools will now analyze files gathered through endpoint DLP queries.</td></tr><tr><td>Does the change modify how admins can monitor, report on, or demonstrate compliance activities?</td><td>Yes. Admins gain new ways to surface, query, and analyze endpoint DLP signals within DSI.</td></tr></tbody></table>

New

Updated June 18, 2026: We have updated the timeline. Thank you for your patience. [Introduction]We’re introducing endpoint Data Loss Prevention (DLP) events as a queryable data source in Data Security Investigations (DSI) in Microsoft Purview. With this update, administrators can build endpoint DLP queries directly in DSI using filters such as date range, and DSI will automatically pull files associated with those events into the investigation for analysis. This integration helps security teams examine endpoint DLP activity at scale, reducing time and effort spent triaging individual alerts and improving the ability to identify patterns and potential data exfiltration scenarios.This message is associated with Microsoft 365 Roadmap ID <a href="https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=558547" target="_blank">558547</a>.[When this will happen]<ul><li>Public Preview: Rollout begins in early June 2026 (previously late April) and completes in late June 2026 (previously early June).</li><li>General Availability (Worldwide): Rollout begins in late July 2026 (previously mid-June) and completes in late July 2026 (previously mid-June).</li></ul>[How this will affect your organization]Who is affectedAdmins and security investigators using Data Security Investigations (DSI) and endpoint Data Loss Prevention (DLP) in the Microsoft Purview compliance portal.What will happen<ul><li>A new Endpoint DLP tab will appear in the DSI search experience, alongside the existing Query Builder and Audit tabs. </li><li>Admins and investigators can query endpoint DLP events using date range filters (additional filters coming soon). </li><li>Files associated with matching endpoint DLP events will be automatically added to the investigation scope for analysis using DSI’s AI‑powered tools. </li><li>This feature will appear automatically for eligible tenants when rollout completes. No admin action is required to enable it.</li><li>There is no user impact.</li></ul>[What you can do to prepare]No action is required. Optionally, you may:<ul><li>Review how endpoint DLP query capabilities work within DSI.</li><li>Update internal documentation for alert triage and investigation workflows, if applicable.</li><li>Inform security teams and endpoint DLP administrators about this new capability.</li></ul>Learn more: <ul><li><a href="https://learn.microsoft.com/purview/data-security-investigations" target="_blank">Learn about Data Security Investigations | Microsoft Purview | Microsoft Learn</a> </li><li><a href="https://learn.microsoft.com/purview/endpoint-dlp-learn-about" target="_blank">Learn about Endpoint data loss prevention | Microsoft Purview | Microsoft Learn</a></li></ul>[Compliance considerations]<table class="table table-bordered"><tbody><tr><td>Question</td><td>Answer</td></tr><tr><td>Does the change alter how existing customer data is processed, stored, or accessed?</td><td>Yes. Endpoint DLP event data becomes queryable in DSI, and associated files are automatically collected into investigations for analysis.</td></tr><tr><td>Does the change introduce or significantly modify AI/ML capabilities that interact with customer data?</td><td>Yes. DSI’s existing AI‑assisted investigation tools will now analyze files gathered through endpoint DLP queries.</td></tr><tr><td>Does the change modify how admins can monitor, report on, or demonstrate compliance activities?</td><td>Yes. Admins gain new ways to surface, query, and analyze endpoint DLP signals within DSI.</td></tr></tbody></table>

June 16, 2026 at 2:30 AM Updated

Summary

Microsoft Purview’s Data Security Investigations (DSI) will integrate endpoint Data Loss Prevention (DLP) events as a queryable data source, enabling admins to analyze associated files automatically. Rollout begins early June 2026 with no user impact or required admin action. This enhances investigation efficiency using AI tools.

New

Last Updated Date

2026-05-18T22:43:48.933Z

New

2026-06-15T23:06:26.517Z

Body Content

Updated May 18, 2026: We have updated the timeline. Thank you for your patience. [Introduction]We’re introducing endpoint Data Loss Prevention (DLP) events as a queryable data source in Data Security Investigations (DSI) in Microsoft Purview. With this update, administrators can build endpoint DLP queries directly in DSI using filters such as date range, and DSI will automatically pull files associated with those events into the investigation for analysis. This integration helps security teams examine endpoint DLP activity at scale, reducing time and effort spent triaging individual alerts and improving the ability to identify patterns and potential data exfiltration scenarios.This message is associated with Microsoft 365 Roadmap ID <a href="https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=558547" target="_blank">558547</a>.[When this will happen]<ul><li>Public Preview: Rollout begins in early June 2026 (previously late April) and completes in early June 2026 (previously mid‑May).</li><li>General Availability (Worldwide): Rollout begins in mid-June 2026 (previously mid‑May) and completes in mid-June 2026 (previously mid‑May).</li></ul>[How this will affect your organization]Who is affectedAdmins and security investigators using Data Security Investigations (DSI) and endpoint Data Loss Prevention (DLP) in the Microsoft Purview compliance portal.What will happen<ul><li>A new Endpoint DLP tab will appear in the DSI search experience, alongside the existing Query Builder and Audit tabs. </li><li>Admins and investigators can query endpoint DLP events using date range filters (additional filters coming soon). </li><li>Files associated with matching endpoint DLP events will be automatically added to the investigation scope for analysis using DSI’s AI‑powered tools. </li><li>This feature will appear automatically for eligible tenants when rollout completes. No admin action is required to enable it.</li><li>There is no user impact.</li></ul>[What you can do to prepare]No action is required. Optionally, you may:<ul><li>Review how endpoint DLP query capabilities work within DSI.</li><li>Update internal documentation for alert triage and investigation workflows, if applicable.</li><li>Inform security teams and endpoint DLP administrators about this new capability.</li></ul>Learn more: <ul><li><a href="https://learn.microsoft.com/purview/data-security-investigations" target="_blank">Learn about Data Security Investigations | Microsoft Purview | Microsoft Learn</a> </li><li><a href="https://learn.microsoft.com/purview/endpoint-dlp-learn-about" target="_blank">Learn about Endpoint data loss prevention | Microsoft Purview | Microsoft Learn</a></li></ul>[Compliance considerations]<table class="table table-bordered"><tbody><tr><td>Question</td><td>Answer</td></tr><tr><td>Does the change alter how existing customer data is processed, stored, or accessed?</td><td>Yes. Endpoint DLP event data becomes queryable in DSI, and associated files are automatically collected into investigations for analysis.</td></tr><tr><td>Does the change introduce or significantly modify AI/ML capabilities that interact with customer data?</td><td>Yes. DSI’s existing AI‑assisted investigation tools will now analyze files gathered through endpoint DLP queries.</td></tr><tr><td>Does the change modify how admins can monitor, report on, or demonstrate compliance activities?</td><td>Yes. Admins gain new ways to surface, query, and analyze endpoint DLP signals within DSI.</td></tr></tbody></table>

New

May 19, 2026 at 2:30 AM Updated

Title

Microsoft Purview: Data Security Investigations – analyze files tied to endpoint DLP alerts

New

(Updated) Microsoft Purview: Data Security Investigations – analyze files tied to endpoint DLP alerts

Summary

Microsoft Purview’s Data Security Investigations will include endpoint Data Loss Prevention (DLP) events as a queryable source, enabling admins to analyze related files automatically. Rolling out April–May 2026, this feature enhances investigation efficiency using AI tools without user impact or required admin action.

New

Last Updated Date

2026-03-21T16:18:50.843Z

New

2026-05-18T22:43:48.933Z

Never Miss a Microsoft 365 Update

Join thousands of IT professionals who rely on DeltaPulse for real-time Microsoft 365 change intelligence, automated notifications, and community insights.

Explore Dashboard Sign Up Free