Investigate and respond to Microsoft Purview Data Loss Prevention alerts

The idea that holds the whole module

Every DLP rule has a section called Incident reports. If that section is off, the rule still blocks or audits. But no alert is created.

When an alert is created, it shows up in two places. The Alerts page in Microsoft Purview shows the policy view. The Incidents queue in Microsoft Defender XDR (extended detection and response) shows the security view.

Simple example. A rule blocks credit card numbers in external email. Ana sends one. The email is blocked. If the rule has Send an alert to admins on, an alert appears. If not, only an event is written to the audit log.

Where Microsoft pages disagree or changed

Checked on 15 November 2026. The exam follows the product. Use the right-hand column.

Alerts are set inside each rule, not in a separate alert policy

There is no "DLP alert policy" object to create. You edit the DLP policy, open a rule and set its Incident reports section.

Sources: Create policy to detect and alert on U.S. PII data exposure; DLP policy reference, Incident reports.

Both create an alert from the same rule. They differ in when the alert fires.

TRAPThresholds by count or volume work only for the All users option. They count matches from many users together. They do not count per user.

An E1, F1, G1, E3 or G3 tenant gets aggregate alerts if it adds one of these:

• Office 365 Advanced Threat Protection Plan 2 (today: Defender for Office 365 Plan 2)
• Microsoft Purview Suite (formerly Microsoft 365 E5 Compliance)
• Microsoft 365 eDiscovery and Audit add-on

TRAPThe list surprises people. A threat protection add-on unlocks a DLP alert feature. The E5 Information Protection and Governance add-on is not on the list in the alerts page.

Source: Get started with the data loss prevention alerts, Licensing for alert configuration options.

What "once per document" means. A file with a Content is shared condition is shared twice. You still get one notification, not two.

For SharePoint and OneDrive rules, DLP sends one alert per file per rule. That is true even when several users commit the same violation.

Default grouping is per rule. Matches from many users in the same window land in one alert.

A tenant setting, user and rule based alert aggregation, changes this. Then each user gets their own alert per rule. The window is 15, 30, 45 or 60 minutes. You set it in DLP settings, not in the rule.

Expect more alerts with per-user grouping on. Source: Compare alert aggregation options.

DLP can feed its matches to Insider Risk Management. For that, the rule's Incident reports severity must be High.

TRAPA Low or Medium severity rule still alerts. It just does not feed Insider Risk Management.

Source: DLP policy reference, Incident reports.

SharePoint and OneDrive: DLP scans new and existing items. An old file can raise an alert.

Exchange: DLP scans only new messages. Mail already in a mailbox is never matched.

Source: Learn about data loss prevention, Viewing policy application results.

The Alerts page needs two roles together

Roles are single permissions. Role groups are bundles of roles. The exam names both. Read which one the question asks for.

To access the DLP alert management dashboard, you need the Manage alerts role and either:

• DLP Compliance Management (view and edit DLP policies), or
• View-Only DLP Compliance Management.

To see file content (Content preview, Matched sensitive content and context), add the Content Explorer Content Viewer role group. It holds the Data Classification Content Viewer role.

Need alerts but not the sensitive text? Build a custom role group without Data Classification Content Viewer. Microsoft suggests exactly this.

Only the roles that matter for alerts are shown. Checked in the role reference on 15 Nov 2026.

Security Operator is the smallest built-in group that meets the two-role rule. Security Administrator and the two Compliance groups also meet it. They add policy editing and many other roles.

VERSIONThe alerts pages also list Security Reader as a group that can view the dashboard. Its alert role is only View-Only Manage Alerts. Read the stem: "view" may accept Security Reader, "manage" or "work" alerts needs Manage Alerts.

Pick Analyst when the team works alerts and must not see content. Pick Investigator when they must also open content in Content explorer.

Administrative units also flow into Defender. An admin restricted to an administrative unit sees only that unit's DLP alerts.

Source: Investigate data loss prevention alerts with Microsoft Defender XDR, Roles.

The policy view: what matched, why, and should the rule change

Path: Purview portal › Data loss prevention › Alerts. The list shows recent DLP alerts. You filter, open one, review, act, then set its status.

1. Data sharing is turned on in Insider Risk Management settings.
2. The user is in scope of an Insider Risk Management policy.

TRAPMissing tab? The fix is in Insider Risk Management, not in DLP. A DLP licence or role change does not bring it back.

Events also show Other matched conditions. They tell you which non-content conditions fired, for example Sender domain is.

• Download the matched content (needs the content viewer role)
• Apply or remove a sensitivity label
• Unshare or delete the file
• Send a notification email
• Copy event link

Copy event link lets a person outside DLP role groups see one event. The link is read-only. It gives no right to edit or act on the alert.

Example. HR must confirm a file is a real payslip. You copy the event link and paste it in the ticket. HR sees the event, nothing else.

Set the status to Investigating while you work. Set it to Resolved when done. Assign an owner and add comments on the Overview tab.

TRAPPurview has no classification field. A false positive is documented in a comment, then the alert is set to Resolved. Defender has a True positive / False positive field.

TRAPResolved does not suppress future alerts. The same action tomorrow creates a new alert. To stop the noise, change the rule: tune conditions, add an exception, or narrow the scope.

The logic: Microsoft can only fetch the copy held in your tenant.

They overlap but are not interchangeable. A summary explains one alert. The agent sorts the whole queue.

Roles to use the agent: Information Protection Analyst or Investigator, Purview Agent Analysis, Security Copilot Contributor. Device alerts also need content viewer and downloader roles, and evidence collection on.

The security view: one incident, many signals

Example. A user downloads files from SharePoint, uploads them to personal OneDrive and shares them outside. Purview shows separate DLP alerts. Defender shows one incident.

Microsoft calls Defender the recommended place to investigate and manage DLP alerts. Purview is the recommended place to create and edit DLP policies.

Since early October 2026 a built-in alert tuning rule turns DLP signals into behaviors. Behaviors do not create alerts. They do not appear in the incident queue.

The signals stay in advanced hunting, in the BehaviorInfo and BehaviorEntities tables.

To see DLP alerts in Defender again: Settings › Microsoft Defender XDR › Alert tuning, then disable the rule.

The training module does not mention this yet. Exam items written earlier assume DLP alerts appear in the queue. Answer them that way, and know this fix for real tenants.

DLP incidents in Defender need one of: Office 365 E5/A5, Microsoft 365 E5/A5, Microsoft 365 E5/A5 Compliance, Microsoft 365 E5/A5 Information Protection and Governance.

TRAPEndpoint alert, no file to open? Turn on evidence collection for file activities on devices. Without it you see metadata only.

Download needs the Data Classification Content Viewer role.

On the incident summary select Manage incident. You can set:

• Severity
• Incident tags
• Assigned to
• Status, for example In progress or Resolved
• Classification: True positive or False positive, with a reason (for example Security testing)

Classification feeds Defender reports. You can then count how much noise each policy makes.

Advanced hunting queries up to 30 days of audit logs. DLP data is in the CloudAppEvents table. It covers SharePoint, OneDrive, Exchange and devices.

From an event, Go Hunt offers built-in queries. For a SharePoint event: File shared with, File activities, Site activity, User DLP violations for last 30 days.

You need access to the CloudAppEvents table first. It comes from connecting Microsoft 365 to Defender for Cloud Apps.

Sentinel adds cross-platform correlation and automated response (SOAR). Use the Microsoft Defender XDR connector to bring DLP incidents in. Ingest CloudAppEvents for the audit data. Then join them in KQL (Kusto Query Language).

let Alert = SecurityAlert
| where TimeGenerated > ago(30d)
| where SystemAlertId == "INSERT_ALERT_ID";
CloudAppEvents
| extend correlationId = tostring(parse_json(tostring(RawEventData.Data)).cid)
| join kind=inner Alert on $left.correlationId == $right.AlertType

Shortened from the module query. Not run in your tenant.

Five tools look alike. The question and the date decide.

VERSIONTwo Microsoft pages disagree on the Alerts page. "Learn about investigating DLP alerts" says it keeps alerts for 30 days. The dashboard page and the module say your audit log retention policy controls it. On the exam, prefer Defender (6 months) or Audit when the event is old. Neither answer then depends on the disputed number.

Activity explorer shows a DLP rule matched event only for rules that audit or act. A rule that simply allows an activity without auditing writes no rule-match event.

This is how you keep audit data small: audit only the risky rule.

Data reaches Activity explorer from the unified audit log. Allow 60 to 90 minutes for Exchange, SharePoint, OneDrive and Teams.

Order questions use exactly these six names. Tune is last.

Export activity data with Export-ActivityExplorerData, or through the Office 365 Management Activity API.

The module on one screen

Your score

Paste the results in the thread. I grade the misses and build the re-test.

Confidence and caveats

0.85. Every key was derived from the Microsoft Learn pages below, opened on 15 November 2026, before reading the vendor key. All vendor keys AGREE. Not higher for four reasons.

• Two Microsoft pages disagree on how long the Purview Alerts page keeps alerts (30 days versus audit log retention). No item here depends on that number alone.
• The October 2026 Defender alert tuning change is newer than the training module. Exam items written before it assume DLP alerts appear in the Defender queue.
• Alert status values in Purview beyond Investigating and Resolved are not confirmed in the pages opened, so they are not taught.
• The KQL query is shortened from the module and was not run. Context7 has no Microsoft Sentinel table library; the syntax follows the Microsoft Learn sample.

Bank coverage: the vendor banks have few DLP alert items. Used: SC401-037 (SC400-033 is the same item), SC401-039, SC401-110.1–3 (re-tests of your M03 misses), originals ORIG-D2-02, ORIG-D3-11 (re-test), ORIG-D3-12. The other 28 items are new, written from the pages below. Report items SC401-044/045/046 (DLP reports) belong to module 13.

Sources (opened 15 November 2026)

• Training module: Investigate and respond to Microsoft Purview Data Loss Prevention alerts (11 units, each unit fetched)
• Get started with the data loss prevention alerts
• Get started with the Data Loss Prevention Alerts dashboard
• Learn about investigating data loss prevention alerts
• Investigate data loss prevention alerts with Microsoft Defender XDR
• Data Loss Prevention policy reference (Rules, Incident reports)
• Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview
• Get started with activity explorer
• Manage audit log retention policies
• Learn about data loss prevention
• Create policy to detect and alert on U.S. PII data exposure