---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Download files for DLP incidents of type Exchange Online, OneDrive, and SharePoint

# Download files for DLP incidents of type Exchange Online, OneDrive, and SharePoint {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Download files or email that violates the DLP policy on Microsoft Purview. Download this file or email on to your local machine from the DLP IR Incident view. You can download the files for DLP IR incidents of type Scan source Exchange Online, OneDrive, and SharePoint.

## Before you begin

Role required:

* sn_dlir.admin, sn_dlir.analyst
* Any valid approver
{#download-file-dlp-microsoft__ul_f34_nks_2yb}

## Procedure

1. Navigate to AllDLP Incident ManagementDLP Analyst Workspace.
2. Open a DLP incident record of type Scan source Exchange Online or OneDrive or SharePoint which is ingested from Microsoft source.
3. Click Download File.  
   The file or email that violated the DLP policy on the Microsoft Purview side will be downloaded to the user's local machine.  
   Note:  
   DLP admin can control the access of Download File action by disabling the Should downloading the violating file of the reported incident be allowed setting from the Advanced Settings page. For more information, see [Configure advanced settings](https://servicenow-prod.fluidtopics.net/wwOHIHO~QiPeMQlpBVMNrw "Configure the advanced settings to customize the incident display and behavior. For example, enable displaying the sensitive data on an incident and its clone, or specifying fields on the incident to identify the end users. In addition, activate and customize the evidence files preview properties.").

*[\>]: and then