Microsoft Purview DLP will introduce user-based alert aggregation, grouping multiple events from the same user into a single alert within a configurable time window. This reduces alert noise, aids investigations, and requires admin activation starting mid-August 2026, without changing policy enforcement.
Applies to: Microsoft Purview
Source: mc.merill.net — data via Merill Fernando's open archive (MIT).