Microsoft Defender XDR will set Microsoft Purview DLP alerts as behaviors by default starting October 12, 2026, reducing alert volume while keeping DLP data accessible in Advanced Hunting and Purview. Administrators can disable this rule to retain DLP alerts in the Defender XDR incident queue.
Applies to: Microsoft Defender XDR · Microsoft Purview
Source: mc.merill.net — data via Merill Fernando's open archive (MIT).