A DLP policy that blocks quietly is only half the job: someone has to look at what matched, decide whether it was a real leak and close the loop. In this post I'll set up alerts worth reading, show where they surface in Microsoft Defender XDR and the Microsoft Purview portal, how to read the evidence, and how to trace what else the user did.
Status (October 2026): Microsoft documents a built-in alert tuning rule for DLP signals that takes effect in early October 2026. In Defender XDR it turns DLP signals into behaviors instead of alerts, so they no longer create alerts or incidents; they stay available in advanced hunting in the BehaviorInfo and BehaviorEntities tables. To keep DLP alerts in the incident queue, disable the rule under Settings › Microsoft Defender XDR › Alert tuning. Re-check Microsoft's page, because this may change.
How it works#
Alerts are configured per rule, in the rule's incident report settings, and come in two kinds:
- Single-event alerts fire on every match. Matches of the same rule close together are still grouped: within one minute with E5 licensing, 15 minutes with E3. A tenant-level user and rule-based aggregation option (preview) groups single-event alerts per user over 15, 30, 45 or 60 minutes.
- Aggregate (threshold) alerts fire when the number of matched activities or the volume of data reaches a threshold within a window of 60 to 999 minutes. They only work with the All users option.
Every organization with a DLP subscription can use single-event alerts; threshold alerts need E5, A5 or G5, or a lower plan with one of the add-ons Microsoft lists. Allow up to three hours for alerts to start after you add or change alert settings.
Prerequisites#
- Alert dashboard: a role group such as Compliance Administrator, Security Operator, Security Reader or one of the Information Protection groups (underneath: Manage alerts plus DLP Compliance Management or its view-only version).
- Seeing the actual content: content preview and the matched sensitive content view require the Content Explorer Content Viewer role group. Analysts who should triage without reading the data can get a custom role without it.
- Defender XDR: a license from Office 365 E5/A5, Microsoft 365 E5/A5, Microsoft 365 E5/A5 Compliance or Microsoft 365 E5/A5 Information Protection and Governance. Administrative unit restrictions in DLP carry over, so a scoped admin only sees alerts for their unit.
- Activity explorer: explicit membership in a role group such as Information Protection Investigators or Compliance Administrator (see Purview roles and role groups).
Step-by-step#
1. Make alerts deliberate#
Edit each DLP rule and review its incident report settings: severity, whether admins get an alert, and whether it fires on every match or on a threshold. A good pattern: single-event alerts for low-volume, high-impact rules and threshold alerts for "many small leaks" rules. If a rule only exists to educate users, don't alert on it at all. More in designing Purview DLP policies.
2. Find the alert#
In Defender XDR (Microsoft's recommended place to investigate): open Incidents & alerts › Incidents, select Add filter, choose Service/detection sources and pick Microsoft Data Loss Prevention. Narrow down with the Entities filter (users, devices) or the Policy/policy rule filter. The benefit is correlation: related DLP alerts, and alerts from other Defender products, land in one incident.
In the Purview portal: open Solutions › Data loss prevention › Alerts. Handy for teams that don't use the Defender portal.
3. Read the evidence#
Each alert event carries the details you need to judge it:
| Look at | Why it matters |
|---|---|
| Policy and rule matched, sensitive info types detected | Tells you which condition fired, which is your starting point for tuning |
| Actions taken; for devices, the violating action | Shows whether data actually left (audit) or was stopped (block) |
| User overrode policy, override justification | A thoughtful justification often means a legitimate process |
| Recipients, subject and attachments (Exchange); site URL and owner (SharePoint, OneDrive); host name and file hash (devices) | Who received the data, where it lives, and which device was involved |
In Defender, Alert story shows the policy and detected types, Related Events the user activity, and the Sensitive info types and Source tabs the matched text and file content (content viewer role required).
4. Trace the user's activity in activity explorer#
Open activity explorer from the Data loss prevention solution and filter by User, Activity type and Location, or start from the predefined filter sets such as DLP policies that detected activities, Egress activities or Endpoint DLP activities. Look for patterns, such as a label downgrade before an upload or many files copied to USB in one afternoon, and save useful combinations as filter sets.
5. Go wider with advanced hunting#
From a DLP event in Defender, Go Hunt (preview) offers built-in queries such as the user's DLP violations for the last 30 days. Or start with these:
// One user's activity in Microsoft 365 apps, last 7 days
CloudAppEvents
| where Timestamp > ago(7d)
| where AccountDisplayName == "Adele Vance"
| summarize Events = count() by Application, ActionType
| order by Events desc
// Behaviors by source (tuned DLP signals land here)
BehaviorInfo
| where Timestamp > ago(7d)
| summarize Behaviors = count() by ServiceSource, ActionType6. Act and close#
For a file in SharePoint or OneDrive, the Defender alert offers in-place actions such as apply a retention or sensitivity label, unshare or delete. For email, Actions › Download email keeps a copy for review. Use the user and device cards for account or device actions, then use Manage incident to tag, assign and resolve. A false positive is a tuning task, not just a closed alert: see tuning DLP false positives.
Verify#
- Trigger a test rule with dummy data from a pilot account. Within a few hours the alert appears in the Purview alerts dashboard and, if the tuning rule is disabled, as an incident in Defender XDR.
- Activity explorer shows the matching event. For Exchange, SharePoint, OneDrive and Teams, allow 60 to 90 minutes, because the data comes from the unified audit log.
- An analyst without the content viewer role can open the alert but not the matched content.
Tips and gotchas#
- Retention is limited. Activity explorer covers 30 days, and how long an alert stays visible depends on your audit log retention policy; see searching the audit log.
- One notification per document. Alert emails, incident reports and user notifications go out once per document, even if it's shared twice.
- Endpoint events show the most restrictive rule only, and activity explorer filters work on that rule.
- Filter dropdowns are built from the first 500 records, so narrow the date range if a user or device is missing.
- Teams false-positive reports show as DLP info entries without real rule details.
- Insider risk context: if insider risk data is shared with Defender XDR, DLP alerts show the user's insider risk severity. See adaptive protection.
