Microsoft Defender XDR
GeneralDlp Investigate Alerts Defender
In brief
The documentation now states that the built-in rule took effect in early October 2026. DLP signals are treated as behaviors, so they do not generate alerts or appear in the incident queue, but remain available in advanced hunting.
What Defender admins need to know
Administrators should use advanced hunting to investigate these DLP signals.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Note
A built-in alert tuning rule for DLP signals will taketook effect in early October 2026. In Microsoft Defender XDR, the rule sets these signals as behaviors instead of alerts, so they don't generate alerts or appear in the incident queue. The signals remain available for advanced hunting in the BehaviorInfo and BehaviorEntities tables. To continue seeing DLP signals as alerts in Microsoft Defender XDR, disable the rule in Settings > Microsoft Defender XDR > Alert tuning. For more information, see Built-in alert tuning rules.
When the built-in DLP alert tuning rule is disabled, you can manage and respond to Microsoft Purview Data Loss Prevention (DLP) alerts and incidents in the Microsoft Defender portal. Open Incidents & alerts > Incidents on the quick launch of the Microsoft Defender portal. From this page, you can:
@@ -49,7 +49,7 @@ platformId: 80e069d9-bde8-cfd5-c801-8833ee9ac3ff Note
-A built-in alert tuning rule for DLP signals will take effect in early October 2026. In Microsoft Defender XDR, the rule sets these signals as behaviors instead of alerts, so they don't generate alerts or appear in the incident queue. The signals remain available for advanced hunting in the [`BehaviorInfo`](advanced-hunting-behaviorinfo-table) and [`BehaviorEntities`](advanced-hunting-behaviorentities-table) tables. To continue seeing DLP signals as alerts in Microsoft Defender XDR, disable the rule in **Settings** > **Microsoft Defender XDR** > **Alert tuning**. For more information, see [Built-in alert tuning rules](investigate-alerts#built-in-alert-tuning-rules).
+A built-in alert tuning rule for DLP signals took effect in early October 2026. In Microsoft Defender XDR, the rule sets these signals as behaviors instead of alerts, so they don't generate alerts or appear in the incident queue. The signals remain available for advanced hunting in the [`BehaviorInfo`](advanced-hunting-behaviorinfo-table) and [`BehaviorEntities`](advanced-hunting-behaviorentities-table) tables. To continue seeing DLP signals as alerts in Microsoft Defender XDR, disable the rule in **Settings** > **Microsoft Defender XDR** > **Alert tuning**. For more information, see [Built-in alert tuning rules](investigate-alerts#built-in-alert-tuning-rules).
When the built-in DLP alert tuning rule is disabled, you can manage and respond to Microsoft Purview Data Loss Prevention (DLP) alerts and incidents in the Microsoft Defender portal. Open **Incidents & alerts** > **Incidents** on the quick launch of the [Microsoft Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2077139). From this page, you can: