Microsoft has changed how Microsoft Purview Data Loss Prevention appears in Microsoft Defender XDR. Since early October 2026, a built-in alert tuning rule treats DLP signals as behaviors. As a result, they no longer generate alerts in Defender XDR by default or appear automatically in the incident queue. For small and midsize businesses this is a clear reason to review DLP workflows, notifications, and automations.
What changed in Defender XDR
Microsoft describes the change in the Learn article for investigating DLP alerts in Defender XDR. A built-in alert tuning rule sets DLP signals as behaviors instead of alerts. The signals are not removed: they remain available for advanced hunting in the BehaviorInfo and BehaviorEntities tables, and DLP incidents can still be handled in the Microsoft Purview portal.
In practice, the familiar security operations view changes most. Teams that used the Defender XDR incident queue as their central worklist will no longer see DLP signals there automatically. That can reduce alert noise, but it can also break processes if reports, tickets, or escalations are created from that queue.
Why this matters for SMBs
Many SMBs do not run a large SOC. They rely on a few administrators, a service partner, and repeatable routines. That makes a quiet display change important. If DLP policies detect sensitive data in email, SharePoint, OneDrive, or endpoint activity, the organization needs to know where those signals now appear and who reviews them. The change therefore affects not only Data Loss Prevention, but also the handoff between compliance, IT operations, and security.
- DLP signals no longer generate Defender XDR alerts by default.
- The information remains available in Advanced Hunting and in the Purview portal.
- Existing routines can be affected if they depend on the Defender XDR incident queue.
Timeline and context
In the public Learn article, Microsoft does not name a single calendar day. It states that the built-in DLP alert tuning rule took effect in early October 2026. The practical review point is therefore now: organizations should not wait until a data protection or DLP incident shows that an expected alert no longer appears in the queue.
The boundary is important too. Microsoft is not turning off DLP. The change affects the default presentation in Defender XDR. If an organization wants DLP signals to continue appearing as alerts, Microsoft says the rule can be disabled under Settings > Microsoft Defender XDR > Alert tuning. That decision should be documented so later reviews understand the operating model.
Which workflows should be checked
The best starting point is a short inventory. This is not licensing advice; it is a technical dependency check. Which DLP policies are active, which alerts were handled in Defender XDR, and which downstream steps depend on an alert?
- Check in Microsoft Defender whether the DLP alert tuning rule is active.
- Compare recent DLP cases in Defender XDR, Advanced Hunting, and the Purview portal.
- Review ticketing, email notifications, SIEM forwarding, and reports for queue dependencies.
- Decide whether fewer alerts are desired or whether DLP should still appear as alerts in Defender XDR.
Microsoft points to the BehaviorInfo and BehaviorEntities tables for the new behavior-based view. Microsoft Graph also documents the /security/runHuntingQuery action for running hunting queries programmatically. For companies with custom reports or automations, this is the technical core of the change: both the portal view and the data access path need to be checked.
A control test should confirm that relevant DLP events can be found in Advanced Hunting, that roles and permissions match the people responsible, and that reporting logic does not assume that every DLP signal must appear as a classic alert. Organizations that run Microsoft Purview and Defender together should document this review as part of a Microsoft Security Assessment.
What companies should do now
First document whether the new default is accepted or the tuning rule is disabled. Then test one current DLP case from the Purview portal through Advanced Hunting, update playbooks, escalation paths, and reports to match the chosen presentation, and inform administrators and data protection contacts where DLP signals should be reviewed.
Official Microsoft sources
- Microsoft Learn: Investigate data loss alerts with Microsoft Defender XDR
- Microsoft Learn: BehaviorInfo table in advanced hunting
- Microsoft Learn: BehaviorEntities table in advanced hunting
- Microsoft Graph: security runHuntingQuery
If you want to verify that DLP alerts, hunting queries, and escalation paths still fit together after the change, we can support you with a technical review of your Microsoft 365 security configuration. Book a short review session.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
