Summary
- Microsoft Purview DLP is adding a new Exchange Online condition: count of labeled documents is greater than, allowing rules to trigger when an email contains more than a configured number of sensitivity-labeled attachments.
- The new condition applies only to Exchange Online DLP policies; it does not apply to SharePoint, OneDrive, Teams, or Endpoint DLP workloads.
- Administrators can combine this volume-based condition with existing DLP criteria and actions to improve protection against high-volume sharing of sensitive content.
- No pre-rollout action is required, but admins should review existing DLP policies, decide on thresholds, and test in audit or simulation mode before enforcing.
Primary Service: Purview
Admin Impact: Medium
User Impact: Low
Release Start: 15 Dec 2026
Release End: 31 Dec 2026
Services: Exchange, M365, Microsoft Purview
Category: Stay informed
Tags: Feature Update, New Feature, User Adoption
History
10/14/2026 Item Added to Message Center
Microsoft Message
Microsoft Purview Data Loss Prevention (DLP) is introducing a new Exchange Online condition: Count of labeled documents is greater than. This condition enables administrators to detect messages that contain a high volume of sensitivity-labeled attachments and trigger DLP actions when a configured threshold is exceeded.
The condition is available for Exchange Online DLP policies and does not apply to SharePoint, OneDrive, Teams, or Endpoint DLP workloads.
This enhancement helps organizations strengthen data protection by identifying potential data exfiltration scenarios where multiple sensitivity-labeled files are shared in a single email. The feature provides an additional volume-based signal that can be combined with existing content-based DLP conditions for layered protection.
Rollout schedule
- Public Preview: Beginning in early November 2026 and expected to complete by early December 2026
- General Availability (Worldwide): Beginning in mid-December 2026 and expected to complete by late December 2026
Impact on your organization
Who is affected
Administrators who manage Exchange Online DLP policies
Platforms and services
- Microsoft Purview Data Loss Prevention
- Exchange Online
- Microsoft Purview compliance portal
What will happen
- Administrators will be able to create DLP rules that evaluate the number of sensitivity-labeled attachments included in a single email message.
- Each attachment with a matching sensitivity label will be counted individually, including duplicate copies of the same file.
- When multiple sensitivity labels are selected in a rule, the condition evaluates the combined count of all matching attachments.
- The condition uses a strict greater-than threshold. For example, a threshold of 3 is triggered when 4 or more matching attachments are detected.
- Administrators can combine this condition with existing DLP conditions and actions for layered protection.
- The feature is administrator configured and is not enabled automatically through existing policies.
- Encrypted (rights-protected) attachments: protection wrapper is excluded to prevent double-counting.
Action required and recommendations
No action is required before rollout.
We recommend that administrators:
- Review existing Exchange Online DLP policies to determine whether attachment count thresholds would improve protection for sensitive content.
- Evaluate appropriate thresholds and policy actions based on organizational risk requirements.
- Test policies in simulation or audit mode before enabling enforcement actions.
- Update internal DLP administration documentation if supported Exchange Online conditions are documented within your organization.
Learn more
- Learn about data loss prevention | Microsoft Learn
- Learn about sensitivity labels | Microsoft Learn
Compliance considerations
Question: Does the change modify, interrupt, or disable Data Loss Prevention (DLP) policies or enforcement?
Answer: Yes. The update adds a new Exchange Online DLP condition that administrators can choose to use when creating or modifying DLP policies.
Question: Does the change alter how admins can monitor, report on, or demonstrate compliance activities?
Answer: Yes. Administrators gain an additional policy condition that can be used to identify and respond to high-volume sharing of sensitivity-labeled content.
Question: Does the change include an admin control and, can it be controlled through Entra ID group membership?
Answer: Yes. Administrators can configure the condition through Microsoft Purview DLP policies. The available information does not indicate that the condition itself can be controlled through Entra ID group membership.