{"id":16383,"date":"2026-05-19T08:01:13","date_gmt":"2026-05-18T23:01:13","guid":{"rendered":"https:\/\/m365jp.net\/?p=16383"},"modified":"2026-05-19T08:02:05","modified_gmt":"2026-05-18T23:02:05","slug":"mc1258000-updated-microsoft-purview-data-security-investigations-analyze-files-tied-to-endpoint-dlp-alerts","status":"publish","type":"post","link":"https:\/\/m365jp.net\/index.php\/2026-05-19-mc1258000-updated-microsoft-purview-data-security-investigations-analyze-files-tied-to-endpoint-dlp-alerts","title":{"rendered":"MC1258000 | (Updated) Microsoft Purview: Data Security Investigations \u2013 analyze files tied to endpoint DLP alerts"},"content":{"rendered":"
\n
\n
\n\n\n\n
MC1258000 | (Updated) Microsoft Purview: Data Security Investigations \u2013 analyze files tied to endpoint DLP alerts<\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n\n\n\n\n\n\n\n
Classification<\/th>\nstayInformed<\/td>\n<\/tr>\n
Last Updated<\/th>\n05\/18\/2026 22:43:48<\/td>\n<\/tr>\n
Start Time<\/th>\n03\/21\/2026 16:18:41<\/td>\n<\/tr>\n
End Time<\/th>\n07\/20\/2026 07:00:00<\/td>\n<\/tr>\n
Message Content<\/th>\n\n

Updated May 18, 2026: We have updated the timeline. Thank you for your patience. <\/p>\n

[Introduction]<\/b><\/p>\n

We\u2019re introducing endpoint Data Loss Prevention (DLP) events<\/b> as a queryable data source<\/b> in Data Security Investigations (DSI) in Microsoft Purview<\/i>. With this update, administrators can build endpoint DLP queries directly in DSI using filters such as date range, and DSI will automatically pull files associated with those events into the investigation for analysis. This integration helps security teams examine endpoint DLP activity at scale, reducing time and effort spent triaging individual alerts and improving the ability to identify patterns and potential data exfiltration scenarios.<\/p>\n

This message is associated with Microsoft 365 Roadmap ID 558547<\/a><\/b>.<\/p>\n

[When this will happen]<\/b><\/p>\n