Summary
- Microsoft Purview network data security policies can now be created and managed without configuring pay-as-you-go when using Microsoft Entra Global Secure Access Internet Access.
- This specifically helps protect sensitive data in network traffic to unmanaged cloud apps and websites, including AI services, through browsers, applications, add-ins, APIs, and other channels.
- Non-Microsoft SASE and secure browser integrations can still be configured, but they will not function until pay-as-you-go is enabled.
- Existing inline web traffic Purview network policies continue to work without interruption.
- Admins should review the new prerequisites and decide whether any non-Microsoft integrations in their tenant still require pay-as-you-go.
Microsoft Purview network data security policies will soon allow creation without pay as you go configuration when using Entra Internet Access with proper licensing. The rollout starts in late September 2026 and finishes by late October 2026. Administrators should review current policy configurations and licensing requirements to prepare for protecting sensitive data across network traffic without extra billing meters.
Administrator impact: Administrators can create network data security policies using Entra Internet Access without setting up pay as you go billing.
End user impact: Sensitive data shared through unmanaged cloud apps and websites will be protected automatically by new network policies.
Score rationale: The update introduces new administrative capabilities and removes previous billing configuration barriers for specific network traffic protection scenarios.
Learn about Microsoft Purview Network Data Security | Entra Global Secure Access Content Filtering
Microsoft Purview network data security policies can now be created without pay-as-you-go configuration, using Entra Global Secure Access Internet Access with appropriate licensing. Non-Microsoft integrations still require pay-as-you-go. Rollout begins late September 2026, enabling policy creation to protect sensitive data in network traffic automatically.
Message ID: MC1478970
Primary Service: Purview
Admin Impact: Medium
User Impact: Low
Release Start: 30 Sept 2026
Release End: 31 Oct 2026
Published: Sep 24, 2026
Expires: 30 Dec 2026
Last updated: 25 Sept 2026
Category: Plan for Change
Service: Microsoft Purview
Tag: New feature, Admin impact
History
9/24/2026 Item Added to Message Center
Microsoft Message
Based on customer feedback, Microsoft Purview network data security policies can be created and managed without configuring pay-as-you-go, regardless of the integration partners. These collection and DLP policies help discover and protect sensitive data shared with unmanaged cloud apps and websites (including AI) through browsers, applications, add-ins, APIs, and other channels.
Microsoft Entra Global Secure Access Internet Access is included with the appropriate per-user, per-month licensing and works without pay-as-you-go. Integrations with non-Microsoft SASE and secure browser partners still require pay-as-you-go. Customers can create and configure policies for these non-Microsoft integrations, but the integrations will not function until pay-as-you-go is configured.
For more information, see Learn about Microsoft Purview Network Data Security
Rollout Schedule
Global: We will begin rolling out on late September 2026 and expect to complete by late October 2026.
Impact on Your Organization
This change becomes available automatically in your tenant as it rolls out. Administrators can then create policies to protect text and files sent and received through network traffic using Entra Internet Access without requiring a pay-as-you-go subscription. Existing inline web traffic Purview policies applied to the network continue to work without interruption.
Action Required/Recommendations
Learn more about the solution, including prerequisites, using the following links:
- Purview network data security: https://learn.microsoft.com/en-us/purview/dlp-network-data-security-learn
- Protect sensitive data in motion across SaaS and AI apps with Microsoft Purview and Microsoft Entra blog: https://aka.ms/networkdatasecurity
- Entra Global Secure Access Content Filtering:https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-network-content-filtering
Compliance considerations
Does the change include an admin control and, can it be controlled through Entra ID group membership?
Yes. The feature includes or affects admin controls, policies, permissions, roles, authentication, or management settings as described in this message. Review the linked documentation or admin center controls for group-based configuration support.
—————————-For Processing Do Not Delete——————————
Do you need to update your Service description: No
Post Publish Date: 9/23/2026
Additional reviewers: [email protected]
Change type: ConfigurationChange
Product marketing manager: [email protected]