Microsoft Message ID

Microsoft is integrating endpoint Data Loss Prevention (DLP) events as a native queryable data source within Data Security Investigations (DSI) in Microsoft Purview. This update allows security administrators to build targeted queries for endpoint activities using specific filters like date ranges. When a query is executed, DSI will automatically pull the files associated with those endpoint DLP events into the investigation scope, enabling deep analysis through AI-powered forensic tools. The goal of this integration is to streamline the triage process and help security teams identify large-scale data exfiltration patterns more efficiently.

#### Impact

• Enhanced Tooling: A new “Endpoint DLP” tab will be added to the DSI search interface, sitting alongside the existing Query Builder and Audit tabs.
• Automated Data Collection: Files involved in endpoint DLP alerts will be automatically ingested into investigations, eliminating the manual effort previously required to gather evidence from distributed endpoints.
• AI-Assisted Analysis: Once files are pulled into DSI, administrators can leverage existing AI-powered investigation tools to analyze the content and context of the potential security breach.
• Administrative Efficiency: Security teams can now analyze endpoint signals at scale rather than investigating individual alerts in isolation.
• Timeline: Public Preview is scheduled to begin in late April 2026, with General Availability (GA) expected by mid-May 2026.
• User Impact: This change is strictly administrative; there is no impact on end-user experience or endpoint performance.

#### Action Required

• No Immediate Activation: This feature will be enabled automatically for all eligible tenants upon rollout. No manual configuration is required to surface the new tab.
• Update Internal Documentation: Update your organization’s Standard Operating Procedures (SOPs) for security investigations and alert triaging to include the new endpoint DLP query workflow.
• Training: Brief your security operations center (SOC) analysts and Purview administrators on how to use the “Endpoint DLP” tab to correlate endpoint events with broader data security investigations.
• Review Permissions: Ensure that investigators have the appropriate roles (such as Data Security Investigator) to access the DSI module and the new endpoint query capabilities.
• Reference Documentation: Review the Microsoft Purview documentation for Data Security Investigations and Endpoint DLP to understand the underlying requirements for event logging and file metadata collection.