MC1508235 - Microsoft Purview | Data Loss Prevention: Count of labeled documents condition for Exchange Online
Microsoft 365 Message Center announcement MC1508235.
MS Message Center's Summary
Microsoft Purview Data Loss Prevention is introducing a new Exchange Online condition to detect emails containing a high count of sensitivity labeled attachments. Rollout begins in early November 2026 for public preview and reaches general availability worldwide by late December 2026. Administrators should review existing DLP policies and consider how volume based sensitivity rules can strengthen organizational data protection.
- Administrator impact
- No direct administrator action is required.
- End user impact
- No direct end user impact is expected.
- Importance
- 4/10: This is a new administrative feature rollout that enhances data loss prevention capabilities without causing immediate service disruption.
Microsoft Summary
Microsoft Purview DLP introduces a new Exchange Online condition to detect emails with a high count of sensitivity-labeled attachments, enhancing data protection. Available from November 2026, it allows admins to set thresholds for labeled files in emails, combining volume and content signals for better DLP policy enforcement.
- Message Center ID
- MC1508235
- Category
- stay Informed
- Severity
- normal
- Services
- Microsoft Purview
- Tags
- New feature, Feature update, User impact
- Roadmap ID
- 562342
- Platforms
- Web
- Published
- 2026-10-14
- Last updated
- 2026-10-14
- Expires
- 2027-01-30
[What and why] Microsoft Purview Data Loss Prevention (DLP) is introducing a new Exchange Online condition: Count of labeled documents is greater than. This condition enables administrators to detect messages that contain a high volume of sensitivity-labeled attachments and trigger DLP actions when a configured threshold is exceeded. The condition is available for Exchange Online DLP policies and does not apply to SharePoint, OneDrive, Teams, or Endpoint DLP workloads. This enhancement helps organizations strengthen data protection by identifying potential data exfiltration scenarios where multiple sensitivity-labeled files are shared in a single email. The feature provides an additional volume-based signal that can be combined with existing content-based DLP conditions for layered protection. [Rollout schedule] Public Preview: Beginning in early November 2026 and expected to complete by early December 2026 General Availability (Worldwide): Beginning in mid-December 2026 and expected to complete by late December 2026 [Impact on your organization] Who is affected Administrators who manage Exchange Online DLP policies Platforms and services Microsoft Purview Data Loss Prevention Exchange Online Microsoft Purview compliance portal What will happen Administrators will be able to create DLP rules that evaluate the number of sensitivity-labeled attachments included in a single email message. Each attachment with a matching sensitivity label will be counted individually, including duplicate copies of the same file. When multiple sensitivity labels are selected in a rule, the condition evaluates the combined count of all matching attachments. The condition uses a strict greater-than threshold. For example, a threshold of 3 is triggered when 4 or more matching attachments are detected. Administrators can combine this condition with existing DLP conditions and actions for layered protection. The feature is administrator configured and is not enabled automatically through existing policies. Encrypted (rights-protected) attachments: protection wrapper is excluded to prevent double-counting. [Action required and recommendations] No action is required before rollout. We recommend that administrators: Review existing Exchange Online DLP policies to determine whether attachment count thresholds would improve protection for sensitive content. Evaluate appropriate thresholds and policy actions based on organizational risk requirements. Test policies in simulation or audit mode before enabling enforcement actions. Update internal DLP administration documentation if supported Exchange Online conditions are documented within your organization. Learn more Learn about data loss prevention | Microsoft Learn Learn about sensitivity labels | Microsoft Learn [Compliance considerations] Question Answer Does the change modify, interrupt, or disable Data Loss Prevention (DLP) policies or enforcement? Yes. The update adds a new Exchange Online DLP condition that administrators can choose to use when creating or modifying DLP policies. Does the change alter how admins can monitor, report on, or demonstrate compliance activities? Yes. Administrators gain an additional policy condition that can be used to identify and respond to high-volume sharing of sensitivity-labeled content. Does the change include an admin control and, can it be controlled through Entra ID group membership? Yes. Administrators can configure the condition through Microsoft Purview DLP policies. The available information does not indicate that the condition itself can be controlled through Entra ID group membership.