Skip to content
Data Loss Prevention Incident Response with Microsoft › Integrate › Data Loss Prevention Incident Response › Security Operations
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Download files for DLP incidents of type Exchange Online, OneDrive, and SharePoint

Download files or email that violates the DLP policy on Microsoft Purview. Download this file or email on to your local machine from the DLP IR Incident view. You can download the files for DLP IR incidents of type Scan source Exchange Online, OneDrive, and SharePoint.

Before you begin

Role required:

  • sn_dlir.admin, sn_dlir.analyst
  • Any valid approver

Procedure

  1. Navigate to All > DLP Incident Management > DLP Analyst Workspace.

  2. Open a DLP incident record of type Scan source Exchange Online or OneDrive or SharePoint which is ingested from Microsoft source.

  3. Click Download File.

    The file or email that violated the DLP policy on the Microsoft Purview side will be downloaded to the user’s local machine.

    Note: DLP admin can control the access of Download File action by disabling the Should downloading the violating file of the reported incident be allowed setting from the Advanced Settings page. For more information, see Configure advanced settings.

Parent Topic:Data Loss Prevention Incident Response with Microsoft