499432 – Microsoft Purview compliance portal: Endpoint Data Loss Prevention — Always-on diagnostics for macOS endpoints (Phase 1)

Product:

Microsoft 365 admin center, Purview, Purview Communication Compliance, Purview compliance portal, Purview Data Loss Prevention

Platform:

Mac, Windows Desktop, World tenant

Status:

In development

Change type:

Links:

Details:

This feature release ‘Always-on diagnostics’, captures critical diagnostic data from onboarded endpoint devices running on macOS for EDLP issue reporting. Comprehensive trace logs will be automatically recorded and stored locally on onboarded Mac devices, eliminating the need to reproduce issues when submitting investigation requests to Microsoft. It allows for the collection of detailed traces over extended periods (up to 90 days). While raising tickets to submit investigation requests to Microsoft regarding Microsoft Endpoint DLP, customers can share enhanced diagnostic information with Microsoft without needing to reproduce the exact scenario.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability

Created:
2025-08-01

updated:
2026-01-21

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

Data Loss Prevention Effectiveness
Without proper preparation, the implementation of always-on diagnostics may lead to an initial increase in false positives in data loss prevention alerts, causing confusion and potential data handling errors among users.
   - roles: IT Security Manager, Compliance Officer
   - references: https://techcommunity.microsoft.com/t5/security-compliance-identity/announcing-microsoft-endpoint-dlp-always-on-diagnostics-for/ba-p/3741230

User Experience Disruption
If the change is implemented without adequate user training and communication, users may experience disruptions in their workflow due to unexpected prompts or alerts generated by the new diagnostic features, leading to frustration and decreased productivity.
   - roles: End User, IT Support Specialist
   - references: https://www.microsoft.com/en-us/microsoft-365/blog/2023/09/12/introducing-microsoft-purview-compliance-portal-for-data-loss-prevention/

Configutation Options**

XXXXXXX ... paid membership only

Data Protection**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

Microsoft has introduced a new feature called "Always-on diagnostics" for macOS devices within the Microsoft Purview compliance portal. This feature is designed to help businesses better manage and troubleshoot issues related to Endpoint Data Loss Prevention (EDLP) on Mac computers.

Think of it like having a security camera in a store. This camera continuously records everything that happens, so if there's ever an incident, you can go back and review the footage to understand what went wrong. Similarly, the "Always-on diagnostics" feature continuously captures critical diagnostic data from Mac devices. This means that if there's an issue with data loss prevention, you don't have to try to recreate the problem to figure out what happened. The information is already recorded and can be reviewed to help resolve the issue.

The data collected is stored locally on the Mac devices for up to 90 days. This is like having a storage room where the security footage is kept for a certain period before it's overwritten. When a business needs to report an issue to Microsoft, they can share this diagnostic information, making it easier and faster to address the problem without having to go through the process of reproducing the exact scenario.

This feature aims to streamline the process of identifying and solving issues, much like how having a reliable security system can help quickly resolve incidents in a store. It provides businesses with a more efficient way to handle potential data loss issues on their Mac devices.