check before: 2025-09-26
Product:
Purview, Purview Communication Compliance, Purview compliance portal, Purview Data Loss Prevention
Platform:
Online, World tenant
Status:
Change type:
Admin impact, Retirement, Updated message
Links:
Details:
Summary:
Starting September 26, 2025, Microsoft Purview will update DLP alert settings to remove "Generate Alert" from rules where corresponding Protection Alerts were disabled via PowerShell. To keep receiving alerts, admins must update and save rules in the portal or re-enable alerts using the Set-DlpComplianceRule cmdlet.
Details:
Updated September 24, 2025: We have updated the content. Thank you for your patience.
Introduction
We have identified that some tenants are using DLP rules in which alert generation has been enabled using the Microsoft Purview portal policy configuration page but the corresponding Alert Policy (Protection Alert) was disabled or deleted using "Set-ProtectionAlert" PowerShell cmdlet (Learn more). Due to this the alert generation gets turned off for the associated DLP rule - even though the alert it appears active on Purview portal policy configuration UX.
If you wish to continue receive alerts for these rules, please take one of the following actions:
Open the rule in the Purview portal, make any update, and save the configuration.
Use the PowerShell cmdlets to re-enable alert generation for the rule. (Learn more)
When this will happen
This change will begin rolling out on September 26, 2025.
Change Category:
XXXXXXX ... free basic plan only
Scope:
XXXXXXX ... free basic plan only
Release Phase:
Created:
2025-08-29
updated:
2025-09-24
Task Type
XXXXXXX ... free basic plan only
Docu to Check
XXXXXXX ... free basic plan only
MS How does it affect me
XXXXXXX ... free basic plan only
MS Preperations
XXXXXXX ... free basic plan only
MS Urgency
XXXXXXX ... free basic plan only
MS workload name
XXXXXXX ... free basic plan only
summary for non-techies**
XXXXXXX ... free basic plan only
Direct effects for Operations**
DLP Alert Generation
If the change occurs without preparation, admins will not receive alerts for DLP rules that have had their corresponding Protection Alerts disabled, leading to potential oversight of data loss incidents.
- roles: Compliance Admin, IT Security Manager
- references: https://learn.microsoft.com/powershell/module/exchangepowershell/set-dlpcompliancerule?view=exchange-ps, https://learn.microsoft.com/powershell/module/exchangepowershell/set-protectionalert?view=exchange-ps
User Awareness
Users may be unaware of data loss incidents due to the lack of alerts, which can lead to compliance issues and data breaches.
- roles: End User, Compliance Officer
- references: https://learn.microsoft.com/powershell/module/exchangepowershell/set-dlpcompliancerule?view=exchange-ps, https://learn.microsoft.com/powershell/module/exchangepowershell/set-protectionalert?view=exchange-ps
Operational Efficiency
The inability to receive alerts may hinder the operational efficiency of the compliance team, as they rely on timely notifications to act on potential data loss.
- roles: Compliance Admin, IT Operations Manager
- references: https://learn.microsoft.com/powershell/module/exchangepowershell/set-dlpcompliancerule?view=exchange-ps, https://learn.microsoft.com/powershell/module/exchangepowershell/set-protectionalert?view=exchange-ps
Configutation Options**
XXXXXXX ... paid membership only
Potentional Risks**
XXXXXXX ... paid membership only
IT Security**
XXXXXXX ... paid membership only
explanation for non-techies**
XXXXXXX ... free basic plan only
** AI generated content. This information must be reviewed before use.
a free basic plan is required to see more details. Sign up here
A cloudsocut.one plan is required to see all the changed details. If you are already a customer, choose login.
If you are new to cloudscout.one please choose a plan.
change history
| Date | Property | old | new |
| 2025-09-24 | MC MessageTagNames | Admin impact, Retirement | Updated message, Admin impact, Retirement |
| 2025-09-24 | MC Summary | Starting September 26, 2025, Microsoft Purview will align DLP alert settings between the portal and PowerShell by disabling alert generation in the portal for rules where PowerShell disabled it. DLP enforcement continues unaffected. Admins must re-enable alerts via portal or PowerShell to keep receiving them. | Starting September 26, 2025, Microsoft Purview will update DLP alert settings to remove "Generate Alert" from rules where corresponding Protection Alerts were disabled via PowerShell. To keep receiving alerts, admins must update and save rules in the portal or re-enable alerts using the Set-DlpComplianceRule cmdlet. |
| 2025-09-24 | MC Last Updated | 08/29/2025 02:31:08 | 2025-09-24T22:32:25Z |
| 2025-09-24 | MC Messages | Introduction
To improve consistency between portal and PowerShell configurations, Microsoft Purview will update how alert generation is handled for Data Loss Prevention (DLP) rules. This change ensures that alert settings in the portal accurately reflect rule configurations made via PowerShell. When this will happen This change will begin rolling out on September 26, 2025. | Updated September 24, 2025: We have updated the content. Thank you for your patience.
Introduction We have identified that some tenants are using DLP rules in which alert generation has been enabled using the Microsoft Purview portal policy configuration page but the corresponding Alert Policy (Protection Alert) was disabled or deleted using "Set-ProtectionAlert" PowerShell cmdlet (Learn more). Due to this the alert generation gets turned off for the associated DLP rule - even though the alert it appears active on Purview portal policy configuration UX. If you wish to continue receive alerts for these rules, please take one of the following actions: Open the rule in the Purview portal, make any update, and save the configuration. Use the PowerShell cmdlets to re-enable alert generation for the rule. (Learn more) When this will happen This change will begin rolling out on September 26, 2025. |
| 2025-09-24 | MC Title | Microsoft Purview compliance portal: Data Loss Prevention - Upcoming Change to DLP Alert Settings | (Updated) Microsoft Purview compliance portal: Data Loss Prevention - Upcoming Change to DLP Alert Settings |
| 2025-09-24 | MC How Affect | We've identified that a few tenants have one or more DLP rules with alert generation enabled in the Microsoft Purview portal, but the corresponding alert action was disabled or removed using PowerShell cmdlets.
To align portal behavior with PowerShell configurations, Microsoft will automatically disable the alert generation toggle in the Purview portal for these rules. The rules will remain active and continue to enforce DLP actions, but alerts will no longer be generated unless reconfigured. This change does not impact the enforcement of DLP policies-only the alert generation behavior. What you can do to prepare No admin action is required unless you want to continue receiving alerts for affected rules. To re-enable alert generation: Open the rule in the Purview portal, make any update, and save the configuration. Use PowerShell to re-enable alert generation for the rule. You can refer to the following cmdlet documentation for guidance: Set-ProtectionAlert Set-DlpComplianceRule Compliance considerations Compliance AreaImpact Alters how existing customer data is processed, stored, or accessedAlert for affected DLP rule actions will no longer be generated unless explicitly re-enabled. Modifies Purview capabilitiesAlert generation for DLP rules will be disabled in the portal if previously removed via PowerShell. Alters how admins can monitor, report on, or demonstrate compliance activitiesAdmins may see fewer alerts in Purview reporting unless rules are reconfigured. Includes an admin controlAdmins can re-enable alert generation via portal or PowerShell. Allows user to enable/disable the featureAdmins can toggle alert generation per rule. | To ensure consistency we will update the DLP rule to remove Generate Alert as an action. Since alerts were disabled using Protection Alert PowerShell cmdlets there will be no change in alert generation behavior for corresponding DLP rule and policy. We are only ensuring there is consistency between DLP rules (with Generate Alert as an action) and their corresponding Alert policies (protection alert)
What you can do to prepare: If you wish to receive alerts for these rules, please take one of the following actions: Open the rule in the Purview portal, make any update, and save the configuration. Use the PowerShell cmdlet "Set-DlpComplianceRule" to re-enable alert generation for the rule. (Learn more). Compliance considerations Compliance AreaImpact Alters how existing customer data is processed, stored, or accessedNo affect. Modifies Purview capabilitiesNo affect. Alters how admins can monitor, report on, or demonstrate compliance activitiesNo affect. Includes an admin controlAdmins can re-enable alert generation if they wish to via portal or Set-"DlpComplianceRule" PowerShell cmdlet. Allows user to enable/disable the featureAdmins can re-enable alert generation if they wish to via portal or Set-"DlpComplianceRule" PowerShell cmdlet. |
Last updated 13 hours ago ago
