Microsoft Purview: Data Loss Prevention-User based alert aggregation Beta
Data as of 2 hours ago (26 October 2026)
Description
User-Based Aggregation consolidates DLP alerts by user identity i.e. a DLP rule violations, in a specified aggregation time window, of the same rule and single user will be aggregated into a single alert enabling quicker triage and remediation. Instead of reviewing alerts containing rule match events of multiple users, DLP admin can now analyze grouped DLP rule match events per user, gaining insights into repeated policy violations and anomalous behavior.
Change history
Added to the roadmap 10 December 2025. Tracked here since 1 September 2026. Earliest target we recorded: February 2026 (since tracked — Microsoft may have moved it before we started watching).
Nothing has changed on this item since tracking began on 1 September 2026. Changes appear here as Microsoft updates the feed.