Microsoft Purview Updates & Release Notes

General availability

Endpoint data loss prevention (DLP) can now monitor sensitive data transferred over FTP and SFTP from managed Windows devices. It can enforce restrictive actions to help prevent data exfiltration. Configure FTP and SFTP transfer activities in your Endpoint DLP policies to get started. See Protect FTP and SFTP transfers with Microsoft Purview Endpoint DLP.

New: Create an Information Barriers policy compliance report to identify SharePoint sites, OneDrive accounts, and user-owned SharePoint Embedded containers that no longer comply after Information Barriers policy changes.

Updated: Data Quality capability requires the Microsoft Purview account and its data sources to be in the same Azure region.

Updated: The Endpoint DLP capability comparison now clarifies that policies for access by apps not included in a restricted apps list or restricted app group are supported on Windows but not on macOS.

Updated: If an Exchange DLP policy uses sensitivity labels as a condition and policy tips while mandatory labeling is enabled, selecting a label from the mandatory-labeling prompt doesn't reevaluate the policy tip. The configured DLP action is still enforced.

Updated:

In cross-tenant Microsoft Teams chats and channels, DLP policy enforcement follows the tenant that initiated the conversation. A user's home-tenant DLP policies don't automatically apply when another tenant hosts the chat or thread.

In preview:

Prepare Endpoint DLP for permission changes in macOS 27

Deploy client version 101.26072 or later, configure protection modes, monitor permission status, and notify users if they disable the required Device Control and Data Access permission.

In preview: Use data loss prevention policies for non-Microsoft connected apps.

Create DLP policies that protect sensitive data at rest in non-Microsoft connected applications, such as Box and Google Workspace. These policies use the existing Microsoft Defender for Cloud Apps connectors and support the same classification engine available for Microsoft 365 locations.

In preview

Sensitivity label policies for non-Microsoft connected apps. Create auto-labeling policies that protect sensitive data at rest in non-Microsoft connected apps, including Box and Google Workspace. These policies use the existing Microsoft Defender for Cloud Apps connectors and support the same classification engine available for Microsoft 365 locations.

New: Before enforcing an auto-labeling policy, run it in simulation mode to identify which items it would label without making any changes. Review the match results and source distribution to determine whether the policy is ready to enforce.

New: The Insights tab in the policy details panel provides an at-a-glance view of an auto-labeling policy's performance. The information shown varies depending on whether the policy is running in simulation or enforcement mode, helping you understand how it identifies or labels content.

The Insights tab in the policy details panel provides an at-a-glance view of an auto-labeling policy's performance. The information shown varies depending on whether the policy is running in simulation or enforcement mode, helping you understand how it identifies or labels content. For more information, see Use the Insights tab to analyze auto-labeling policies in Microsoft Purview.

Updated: Microsoft Purview protection policies no longer support Azure SQL Database.

New: Configure a manual business continuity and disaster recovery environment for Microsoft Purview Data Map. The guidance covers creating a secondary account, mirroring scans, validating the environment, and requesting account promotion during a regional outage.