Microsoft Purview: Data Loss Prevention - Count of Labelled Documents Condition
A new DLP condition for Exchange Online policies enables detection of emails with multiple labeled sensitive attachments exceeding a configured threshold. This allows organizations to flag high-volume data exfiltration attempts where individually low-risk files collectively pose compliance risks.
Microsoft's description
This release introduces a new condition for Exchange Online policies: “Count of labeled documents is greater than.” This condition evaluates the number of attachments in an email message that carry a matching sensitivity label. When the count exceeds a defined threshold, the DLP rule is triggered, and configured actions are applied. This capability enables detection of high-volume data exfiltration scenarios, where multiple sensitive files—individually low-risk—collectively represent a significant compliance or security risk. Existing conditions evaluate file content, but do not provide controls based on the volume of labeled attachments.