Download files for DLP incidents of type Exchange Online, OneDrive, and SharePoint

  • Release version: Australia
  • Updated March 12, 2026
  • 1 minute to read

    • Download files or email that violates the DLP policy on Microsoft Purview. Download this file or email on to your local machine from the DLP IR Incident view. You can download the files for DLP IR incidents of type Scan source Exchange Online, OneDrive, and SharePoint.

    Before you begin

    Role required:
    • sn_dlir.admin, sn_dlir.analyst
    • Any valid approver

    Procedure

    1. Navigate to All > DLP Incident Management > DLP Analyst Workspace.
    2. Open a DLP incident record of type Scan source Exchange Online or OneDrive or SharePoint which is ingested from Microsoft source.
    3. Click Download File.
      The file or email that violated the DLP policy on the Microsoft Purview side will be downloaded to the user’s local machine.
      Note:
      DLP admin can control the access of Download File action by disabling the Should downloading the violating file of the reported incident be allowed setting from the Advanced Settings page. For more information, see Configure advanced settings.