493291 – Microsoft Purview compliance portal: Data Loss Prevention – Detection of True file type in EXO DLP

Product:

Exchange, Purview, Purview Communication Compliance, Purview compliance portal, Purview Data Loss Prevention

Platform:

US Instances, Web, World tenant

Status:

Launched

Change type:

Links:

MC1085582

Details:

Traditionally, Exchange has relied solely on the file extension (e.g., .docx, .pdf) to identify the type of an attachment. However, this approach can be bypassed if a file is renamed with a misleading extension. To address this, we’re enhancing our detection logic to go beyond just the visible file extension. With this update, even if a file’s extension is altered, Exchange will evaluate the actual content of the file to determine its true type. This ensures that policies based on file type—such as “File extension is…”—remain effective and secure, even in cases of renamed or disguised attachments. This improvement provides customers with a more robust and reliable way to enforce compliance and security rules around file sharing.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2025-05-10

updated:
2026-01-21

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Please, look at the most relevant linked item for details

explanation for non-techies**

Imagine you have a library where books are organized by the color of their covers. Traditionally, if you wanted to find a mystery novel, you might look for books with a dark cover because most mystery novels have dark covers. However, someone could easily put a romance novel in a dark cover, and you would mistakenly think it's a mystery novel just by looking at the cover.

In the world of email and file attachments, this is similar to how Exchange used to identify files based on their extensions, like .docx for Word documents or .pdf for PDFs. Just like the book cover analogy, this method could be tricked if someone simply changed the file extension without changing the actual content of the file.

To address this, Microsoft is enhancing its system to look beyond the "cover" or file extension. It's like opening the book and reading a few pages to determine its true genre, regardless of the cover color. This means that even if someone renames a file to disguise its type, Exchange will now analyze the content of the file to identify what it really is.

This improvement is important for maintaining security and compliance. It ensures that rules based on file types are enforced correctly, preventing sensitive information from being shared inappropriately, even if someone tries to disguise the file by changing its extension. This makes the system more reliable and helps organizations protect their data more effectively.