Microsoft Purview Data Loss Prevention default protection controls for Exchange Online when classification fails

Updated July 13, 2026: We have updated the timeline. Thank you for your patience.  What and Why Microsoft Purview Data Loss Prevention (DLP) is introducing new capabilities to detect and act on classification failures such as timeout, throttling, and scan errors. This update helps administrators surface previously undetected failures and apply appropriate protection, improving visibility and strengthening compliance outcomes across Exchange Online. This message is associated with Microsoft 365 Roadmap ID 561916. Rollout Schedule Public Preview: Rollout begins in mid-July 2026 (previously mid-June) and is expected to complete by late July 2026 (previously early July). General Availability (Worldwide): Rollout begins in mid-August 2026 and is expected to complete by late August 2026. Impact on Your Organization Who is affected Admins managing Microsoft Purview DLP policies in Exchange Online Platforms/Services: Exchange Online Microsoft Purview Data Loss Prevention What will happen The feature is turned off by default and requires explicit tenant-level opt-in. There is no change to existing behavior or user experience unless you enable the feature. Existing DLP conditions will expand to detect additional classification failure scenarios after opt-in is enabled. New classification failure categories include: timeout throttling other scan errors. A new condition called DocumentScanFailures allows targeting specific failure types and must be used with existing scan conditions. You may see an increase in DLP alerts and rule matches after enabling the feature. This reflects previously undetected classification failures and does not indicate new issues. Updated condition behavior Document couldn't be scanned will detect:Text extraction failures Classification failures such as timeout, throttling, and other scan errors after opt-in Document didn't complete scanning will detect:Partial text extraction Partial classification failures where some classifiers succeed and others fail New condition DocumentScanFailures enables detection of specific failure types including timeout, throttled, and other errors. Must be used with either Document couldn't be scanned or Document didn't complete scanning. Cannot be used as a standalone condition. Action Required and Recommendations To prepare for this update: Review existing DLP policies that use these conditions:Document couldn't be scanned Document didn't complete scanning Plan when to enable the tenant-level opt-in based on your readiness. Enable the feature using PowerShell:Connect using Connect-IPPSSession. Run the following commands: $json = '{"Classification":{"State":1}}' Set-PolicyConfig -DlpErrorHandlingConfig $json Allow up to one hour for the configuration to take effect. Configure rule priority to ensure proper evaluation:Place content-based rules above scan failure rules. Scan failure conditions only evaluate classifiers that have already run. Example rule order: Detect credit card numbersCondition: Content contains credit card number Action: Block Detect account numbersCondition: Content contains account number Action: Block Detect exact data matchCondition: Content contains EDM sensitive information type Action: Block Catch full scan timeout failuresCondition: Document couldn't be scanned and DocumentScanFailures set to timeout Action: Audit Catch partial scan throttlingCondition: Document didn't complete scanning and DocumentScanFailures set to throttled Action: Audit Catch other scan errorsCondition: Document couldn't be scanned and DocumentScanFailures set to other Action: Audit Monitor results using Activity Explorer and DLP alerts to understand classification failure patterns. Communicate this change to security and compliance teams. You can disable the opt-in setting to return to previous behavior if needed. Compliance considerations Question Answer Does the change alter how existing customer data is processed, stored, or accessed? Yes. Classification failures are now surfaced and evaluated as part of DLP processing, which changes how content scanning outcomes are interpreted. Does the change modify DLP policies or enforcement? Yes. Existing DLP conditions are expanded and a new condition is introduced, impacting rule evaluation behavior. Does the change alter how admins can monitor, report on, or demonstrate compliance activities? Yes. Admins gain enhanced visibility into classification failure scenarios through DLP alerts and Activity Explorer. Does the change include an admin control? Yes. The feature requires explicit tenant-level opt-in through PowerShell and can be disabled.