481343 – Microsoft Purview compliance portal: Data Loss Prevention: Enrich the details of the auto forwarded emails in the Exchange DLP

Product:

Exchange, Purview, Purview Communication Compliance, Purview compliance portal, Purview Data Loss Prevention

Platform:

Web, World tenant

Status:

Launched

Change type:

Links:

Details:

We are excited to introduce an enhancement to our system that will provide more accurate and detailed information for forwarded emails. This new feature will ensure that the correct user, recipient information, and email evidence are displayed in the alert generated. This improvement will help admins accurately trace the origin and intended recipient of forwarded emails, reducing confusion and minimizing the risk of false positives. The update will be reflected in our audit logs, alerts page, and activity explorer page

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2025-02-14

updated:
2026-01-21

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Inaccurate Data Reporting
Without proper preparation, the new feature may lead to inaccurate data reporting in audit logs, causing confusion among administrators regarding the source and recipient of forwarded emails.
   - roles: IT Administrators, Compliance Officers
   - references: https://techcommunity.microsoft.com/t5/security-compliance-identity/microsoft-purview-compliance-portal-data-loss-prevention/ba-p/3651230

Increased User Frustration
If the change is implemented without adequate training or communication, users may experience frustration due to unexpected changes in how email forwarding is monitored, leading to potential disruptions in their workflow.
   - roles: End Users, IT Support Staff
   - references: https://techcommunity.microsoft.com/t5/security-compliance-identity/microsoft-purview-compliance-portal-data-loss-prevention/ba-p/3651230

Configutation Options**

XXXXXXX ... paid membership only

Data Protection**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

Microsoft has introduced an enhancement to its Purview compliance portal, specifically focusing on Data Loss Prevention (DLP) for auto-forwarded emails in Exchange. This update aims to provide more detailed and accurate information about forwarded emails, helping administrators better track and manage email activity.

Imagine you are a librarian responsible for keeping track of all the books being borrowed and returned. Previously, if someone borrowed a book and then passed it to a friend, you might only know that the book left the library, but not who currently has it. This new feature is like having a system that not only tells you who borrowed the book but also who they passed it to. This way, you can trace the journey of the book more accurately.

Similarly, in the digital world, when an email is forwarded, it can be important to know who originally sent it, who received it, and who it was forwarded to. This enhancement ensures that when an email is forwarded, the system captures and displays all relevant details about the original sender, the recipient, and the forwarding action. This helps reduce confusion and minimizes the chances of mistakenly identifying legitimate email forwarding as a potential security threat.

These improvements will be visible in various parts of the Purview compliance portal, such as audit logs, alerts, and activity explorer pages. By having this detailed information readily available, administrators can make more informed decisions and take appropriate actions when necessary.