MC1181277 – Endpoint Data Loss Prevention: Always-on diagnostics for Windows Endpoints (Phase 2)

Product:

Entra, Microsoft 365 Apps, Microsoft 365 suite, Purview, Purview Communication Compliance, Purview compliance portal, Purview Data Loss Prevention, Purview Information Protection, Windows

Platform:

Online, Web, Windows Desktop, World tenant

Status:

Rolling out

Change type:

New feature, Admin impact

Links:

499431

Details:

Summary:
Microsoft is introducing Always-on diagnostics for Windows endpoints (Phase 2) in Endpoint Data Loss Prevention, enabling admins to retrieve and selectively upload diagnostic traces via the Purview portal without user disruption. Rollout starts October 2025 (preview) and February 2026 (general availability). No immediate action required.

Details:
[Introduction]
To support faster, more seamless investigations, Microsoft is introducing Always-on diagnostics for Windows endpoints (Phase 2). This enhancement allows admins to retrieve diagnostic traces directly from Windows devices and selectively upload them to Microsoft via the Purview portal-without disrupting end users. This update is based on customer feedback to reduce friction during support escalations and improve troubleshooting efficiency.
This message is associated with Roadmap ID 499431.
[When this will happen:]
Public Preview (Worldwide): Rollout begins in late October 2025 and completes by late October 2025.
General Availability (Worldwide): Rollout begins in mid-February 2026 and completes by late February 2026.
[How this affects your organization:
Who is affected: Admins managing Endpoint Data Loss Prevention (DLP) on Windows endpoints via Microsoft Purview.
What will happen:
Admins can retrieve Always-on diagnostic traces from Windows endpoints.
Traces can be selectively uploaded to Microsoft through the Purview portal during investigations (e.g., support ticket submission).
No user interaction or disruption is required, and admins can reference the upload request number to Microsoft Support for investigations.
The feature enhances eDLP troubleshooting capabilities without impacting Information worker productivity.
This capability is integrated into the existing Endpoint DLP experience.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
General Availability, Preview

Created:
2025-10-29

updated:
2025-10-29

Public Preview Start Date

XXXXXXX ... free basic plan only

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

linked item details

XXXXXXX ... free basic plan only

summary for non-techies**

XXXXXXX ... free basic plan only

Direct effects for Operations**

User Experience Disruption
If the change is implemented without proper preparation, there may be confusion among users regarding the new diagnostic capabilities, leading to potential anxiety about data privacy and security.
   - roles: Information Workers, Helpdesk Support
   - references: https://learn.microsoft.com/purview/dlp-always-on-diagnostics, https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=499431

Admin Workflow Inefficiency
Without preparation, admins may struggle to integrate the new diagnostic features into existing workflows, leading to delays in troubleshooting and support ticket resolution.
   - roles: IT Admins, Compliance Officers
   - references: https://learn.microsoft.com/purview/dlp-always-on-diagnostics, https://www.microsoft.com/microsoft-365/roadmap?filters=&searchterms=499431

Configutation Options**

XXXXXXX ... paid membership only

Data Protection**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only